Webhook Mock Sender

What Webhook Mock Sender does

It removes the provider from the loop. No dashboard, no test mode, no tunnel. Just a signed request arriving at your endpoint, and a report of what your endpoint said back.

Quick start

Run it without installing anything, using uv:

export STRIPE_WEBHOOK_SECRET='whsec_...'   # the secret your endpoint verifies against

uvx --from git+https://github.com/webhooker-eu/webhook-mock-sender \
  webhook-mock-sender send stripe payment_intent.succeeded http://localhost:3000/webhooks/stripe

Stripe payment_intent.succeeded → http://localhost:3000/webhooks/stripe
✓ Delivery: HTTP 200 in 12 ms
  response    {"received": true}

Or through Docker, where host.docker.internal is your machine as seen from inside the container:

docker run --rm --add-host host.docker.internal:host-gateway \
  -e STRIPE_WEBHOOK_SECRET ghcr.io/webhooker-eu/webhook-mock-sender \
  send stripe payment_intent.succeeded http://host.docker.internal:3000/webhooks/stripe

The secret comes from --secret, or from the variable you probably already have: STRIPE_WEBHOOK_SECRET, GITHUB_WEBHOOK_SECRET, SHOPIFY_WEBHOOK_SECRET, with WEBHOOK_MOCK_SECRET as a fallback for any provider.

Testing the unhappy paths

A handler that accepts a correctly signed event proves very little. The interesting tests are the ones a provider will not run for you:

# A wrong signature must be refused
webhook-mock-sender send stripe invoice.paid "$URL" --invalid-signature --expect 400

# Signed 10 minutes ago: Stripe's libraries allow 5, so this is a replay
webhook-mock-sender send stripe invoice.paid "$URL" --timestamp-offset -600 --expect 400

# The same delivery twice: the handler should process it once
webhook-mock-sender send github push "$URL" --repeat 2

With --expect, the exit code is 0 only when your endpoint answers with that status, so these lines work as assertions in CI. If the endpoint accepts a request with a wrong signature, the tool says so in as many words: your endpoint does not verify signatures.

Changing the payload

# Change fields of the template
webhook-mock-sender send stripe invoice.paid "$URL" \
  --set data.object.total=9900 \
  --set data.object.customer_email=ada@example.com

# Sign and send your own body, byte for byte
webhook-mock-sender send github label "$URL" --payload-file event.json

# Look at the signed request without sending it
webhook-mock-sender send stripe charge.refunded --dry-run
webhook-mock-sender send shopify orders/paid "$URL" --curl

How each provider signs a webhook

All three use HMAC-SHA256 with a shared secret over the raw request body. What differs is the header, the encoding, and whether a timestamp is part of the signed string.

Which events are included

The payloads follow the providers' documented shapes but are trimmed: they exercise your handler's plumbing, not every field of the provider's API reference. For anything not listed, pass the real JSON with --payload-file.

Inside a test suite

The same request can be built in Python and handed straight to your framework's test client, so a signature test runs without a network:

from webhook_mock_sender import build_mock_request, get_provider

mock_request = build_mock_request(
    get_provider("stripe"),
    "payment_intent.succeeded",
    "whsec_test_secret",
    overrides=["data.object.amount=5000"],
)

# In a test, without a network
response = test_client.post(
    "/webhooks/stripe",
    content=mock_request.body,
    headers=mock_request.headers,
)

From testing to production traffic

Mock events tell you your handler is correct. They say nothing about what happens when your service is redeploying at the moment a real payment lands, or when a provider gives up after three failed attempts. That is a delivery problem, not a verification one.

Webhooker takes it over: one EU-hosted ingest URL per source, the provider's signature verified before the payload is accepted, every event stored durably, six delivery attempts over about five hours, a dead-letter queue and one-click replay. The free plan covers 10,000 events a month.

Frequently asked questions

Further reading

• Verifying Stripe webhook signatures
• Webhook signature verification failed: 6 causes and fixes
• Verifying GitHub webhook signatures
• Webhook replay attacks and timestamp tolerance
• Idempotency keys for webhook consumers

More open-source tools

Everything we publish lives in the webhooker-eu GitHub organisation, and the full list with a short description of each is on the open-source tools page.