Tool

Webhook inspector

A throwaway URL that writes down exactly what a provider sends — before you have written a line of code to receive it.

How it works

A bin is a URL at https://tesseract.page/h/{slug}. It accepts any method, records the request, and replies with whatever status code you gave it. Point a provider's webhook settings at it and the deliveries show up in the panel.

curl -X POST https://tesseract.page/h/abc123 \
  -H 'content-type: application/json' \
  -d '{"event":"invoice.paid"}'

What gets recorded

• Method, any path appended after the slug, and the query string.
• Every header, minus Cloudflare's own cf-* noise.
• The body, up to 64 KB. JSON is pretty-printed on the way out.
• The country the request came from.

What does not

Credentials are redacted before anything is written down.authorization, cookie, x-api-key and their neighbours are stored as Bearer [redacted, 214 chars] — the shape survives, the secret does not. No IP addresses are stored, here or anywhere else on this site.

Choosing the reply

A bin can answer with any of a dozen status codes. That is the point of it: set a bin to 500 and you can watch a provider's retry schedule for real instead of reading about it.

Limits

• The last 100 requests per bin are kept; older ones are pruned as new ones arrive.
• Bodies past 64 KB are stored truncated, with the original size noted.
• Binary payloads are recorded as a size, not as mojibake.
• Bins can carry an expiry. After it passes the URL answers 410.

Receiving is public — a webhook you have to sign into cannot receive a third party's callback. Creating and reading bins is not: they only exist because someone with admin access made one.