Webhook Kit — inspect, verify & replay webhooks on YOUR Cloudflare account

What's inside the kit

One zip: a single dependency-free worker (the dashboard is built into it), two D1 tables and copy-paste docs. Nothing to install, no build step, no vendor login.

Capture

One URL catches everything

Any HTTP method, any body, at /w/<inbox> — inboxes create themselves on first hit and the worker answers 2xx so providers stop retrying. Point Stripe, GitHub, Shopify, cron jobs or your own services at it.

Inspect

Every header, every byte

A private dashboard lists each event with method, path, size, truncated source IP and a pretty-printed body. Copy any delivery as a ready-to-run cURL command.

Signature

Verdicts in plain language

HMAC presets for Stripe, GitHub and Shopify. When a signature fails, the badge says why — which secret to set, a timestamp outside Stripe's 5-minute tolerance, or a genuine mismatch.

Replay

Send it again, anywhere

One click resends the stored method, headers and body to any URL — hop-by-hop headers stripped, each attempt logged with status and duration. Test a fix without waiting for the provider.

Alerts

Your chat, not someone's inbox

Optional Discord and Telegram pings on every captured event — one secret each, fire-and-forget, capture speed unaffected. See deliveries where you actually look.

Hygiene

Privacy by construction

Source IPs truncated at ingest, nightly retention sweep (7 days by default), per-inbox event caps, zero third-party scripts in the dashboard. Payloads live in your own D1 database.

Live in three steps

The included SETUP.md is five copy-paste commands. If you have pasted a command into a terminal before, you are qualified.

Deploy the worker

wrangler login, d1 create, paste the id, one secret, deploy — about 20–30 minutes, all on Cloudflare's free tier at the time of writing.

Point a provider at it

Paste your capture URL into Stripe, GitHub or Shopify, add the matching signing secret, and send a test delivery from their dashboard.

Debug with evidence

Read the exact bytes each provider sent, see a signature verdict with a reason, replay to staging or production after every fix.

What this kit is — and is not

It is a self-hosted tool: your Cloudflare account, your database, your ops. The dashboard has no team features, no SSO and no mobile app. Replay is manual and on-demand — it does not run retry schedules or queues for you, and the alerts fire when an event is captured, not when your own application misbehaves.

Defaults are sized for the free tier: 20 inboxes, 500 events per inbox, 7-day retention, 64 KB per stored body. Every limit is one variable in the config file, and the docs show where to change it. Free tiers change — "at the time of writing" is the honest phrasing, and the kit makes no uptime promises because it runs on infrastructure you control.

Webhook Kit · single-business license

฿1,490

one-time payment · ≈ US$42

Hosted inspectors bill monthly, forever. This is once — then it's yours.

Capture + inspect + signature verdicts + one-click replay
Discord + Telegram alerts, retention sweep, private dashboard
SETUP + CUSTOMIZE guides, API reference, D1 schema
Free updates for v1.x · runs on Cloudflare's free tier

Buy Webhook Kit — ฿1,490

14-day money-back guarantee, no questions — email the address on your receipt. Secure checkout by Stripe; promotion codes accepted.

Questions people actually ask

Something else? Email the address on your receipt — every message gets a personal reply.

Do I need to be technical to set this up?

If you can paste five commands into a terminal, SETUP.md gets you there in about 20–30 minutes: wrangler login, create the database, paste one id, set one secret, deploy. No npm packages to install, no build step, no Docker. A troubleshooting table covers every common symptom.

Is this a hosted service?

No — that is the point. The worker runs on your own Cloudflare account and payloads land in your own D1 database. Nothing phones home. You get the control and the privacy of self-hosting, and the responsibility of it too: you own the deployment.

Does it really run on Cloudflare's free plan?

Yes at the time of writing: the shipped defaults (20 inboxes, 500 events per inbox, 7-day retention) sit far inside the free request and D1 limits for solo debugging use. The docs state the limits honestly and show which variable to raise if you need more.

Which webhook providers does it support?

Any HTTP sender can be captured — the endpoint accepts any method and body. Built-in signature presets cover Stripe, GitHub and Shopify; other providers' deliveries are stored and replayable, just without a signature verdict.

Can replay re-trigger my production handler safely?

Replay resends the stored method, headers and body to any URL you choose, with hop-by-hop and Cloudflare headers stripped. Signature headers are kept, so a destination that verifies them behaves exactly as it would with a live call — which is why the docs suggest pointing the first replay at staging.

Where does my data live, and for how long?

In the D1 database of the Cloudflare account you deploy to — nowhere else. A nightly sweep deletes events older than your retention setting (7 days by default), source IPs are truncated at ingest, and the dashboard loads zero third-party scripts.

What about updates?

v1.x updates are included: replace worker.mjs with the newer file and run the same deploy command. The schema is additive, so updates do not ask you to delete your data.

What is the refund policy?

14 days, full refund, no questions. Email the address on your Stripe receipt within two weeks of purchase and you get your money back. The license is per business; agencies running it for several businesses can email about extended licensing.

See every webhook, verify its signature, replay it — on your own Cloudflare account