From webhook to answer.

HookBench captures HTTP requests so you can inspect integrations without guessing.

1. Create your inbox

Sign in with ChatGPT and create a project. Copy its secret endpoint URL into the webhook settings of your provider. Keep that URL private: anyone who knows it can send requests to your inbox.

2. Send an event

Use “Send test event” in your workspace, trigger a provider event, or run this command after replacing YOUR_ENDPOINT:

curl -X POST 'YOUR_ENDPOINT' \
  -H 'Content-Type: application/json' \
  -d '{"event":"order.created","test":true}'

Accepted requests receive HTTP 202. The inbox refreshes every five seconds and shows the latest 200 unexpired requests. Payloads must be UTF-8 text and no larger than 64 KB. Binary uploads are not supported.

3. Inspect and compare

Choose a request to see its formatted payload and headers. Use Compare payloads to view two requests side by side. Save useful requests as test cases, then send them back into your inbox later. Up to 50 cases are available per project.

4. Verify and replay

In Project settings, enter your exact HTTPS destination. Publish the provided token at /.well-known/hookbench-verification.txt on that host, then select Verify destination. Verification lasts 30 days. Replays preserve the original method and text payload, with a new Content-Type and X-HookBench-Replay header. They do not preserve authentication or signatures. Configure your test receiver accordingly.

Only destinations you control are allowed. Redirects, IP-literal destinations, and private addresses are blocked. Each replay times out after 10 seconds; its response status and duration are shown.

Limits and retention

Free: one project, 100 events per UTC calendar month, 20 events per minute, and 24-hour request history. Pro: ten projects, 10,000 events per month, 120 events per minute, and seven-day history. Both plans allow ten replay attempts per minute and ten destinations per project. Saved cases persist until deleted.

Expired events are hidden immediately. Physical deletion runs in bounded batches as the app receives traffic. Avoid sending personal data, passwords, production secrets, or payment card details. Common sensitive headers are removed; payload contents are not automatically redacted.

Billing and cancellation

When paid plans are available, use Pricing to subscribe or open the Lemon Squeezy customer portal. Cancelling preserves Pro access until the subscription end date. Failed or expired subscriptions fall back to Free limits. Existing projects remain accessible, but new project creation follows your current plan.