Webhook bugs are miserable to debug by deploying: change a line, push, wait, trigger, read logs, repeat. The faster loop is making the provider deliver straight to the code running in your editor — which needs two things: a public URL that forwards to localhost, and a way to see exactly what arrived.
What a webhook testing tool needs
- A public HTTPS URL — Stripe, GitHub, Shopify and the rest refuse to deliver to
localhost. A tunnel fixes that. - A live inspector — half of webhook debugging is discovering the payload does not match the docs. You want method, headers, body and timing for every delivery, as it happens.
- Your real handler in the loop — inspecting payloads on a throwaway URL is reading; testing is when the delivery hits your code and you see your response go back.
The free options
SchemaClient does all three in one free desktop app: a built-in tunnel gives your dev server a public URL, and the real-time monitor shows every delivery and your handler's response. No usage caps, no account to start. The step-by-step walkthrough is in testing webhooks locally.
webhook.site is a great inspector: instant throwaway URL, shows every request. But forwarding to your localhost — the part that makes it a tester rather than a viewer — sits in the paid tier.
ngrok pairs a tunnel with a local web inspector. It works; the free tier's random URLs mean re-registering your endpoint with the provider after every restart, which gets old fast. Comparison: free ngrok alternative.
Provider CLIs — Stripe's CLI forwards its own events to localhost nicely. If you only ever integrate Stripe, it may be enough; the day you add GitHub or Twilio webhooks you are back shopping for a general tool.
The debugging workflow that works
- Start your app locally, note the port.
- Start the tunnel, register the public URL with the provider (test mode).
- Trigger a test event from the provider's dashboard.
- Watch the delivery land in the monitor: is the signature header present? Is the payload shape what your handler expects? What status did you return?
- Fix, save, trigger again — no deploy in the loop.
Two habits worth keeping: always verify the provider's signature in your handler (a tunnel does not change security requirements), and when a webhook works in production but not locally, diff the headers first — proxies strip more than you think.
Download SchemaClient free — tunnel, inspector and API client in one app, which is exactly the toolkit webhook debugging needs.