Webhook Test Payload Generator

What does this tool do?

It generates realistic sample webhook payloads for six popular platforms — GitHub, Stripe, Shopify, Slack, Twilio, and SendGrid — so you can test your webhook receiver without waiting for a real event to trigger one. Each payload comes with the provider's actual headers and, if you supply a signing secret, a correctly-computed HMAC signature.

How this tool works

1. Pick a platform and an event type — the event list updates to match whichever platform you choose (a GitHub push, a Stripe payment_intent.succeeded, a Shopify orders/create, and so on).
2. Optionally enter a webhook secret to have the tool compute a real signature header, and a target URL to build a ready-to-run cURL command against.
3. Click Generate to produce a fresh payload — every click generates new random IDs, amounts, and timestamps, so you get a new realistic sample each time.

The output gives you the Payload (JSON, or form-encoded for Twilio, which sends webhooks that way), the Headers the platform would actually send, and a cURL Command you can paste directly into a terminal to fire the request at your own endpoint.

Provider-correct signing

Each platform signs its webhooks differently, and this tool reproduces the real scheme when you supply a secret:

• GitHub — HMAC-SHA256 (and legacy SHA1) of the raw body, in X-Hub-Signature-256 / X-Hub-Signature.
• Stripe — HMAC-SHA256 of {timestamp}.{body}, in Stripe-Signature as t=...,v1=....
• Shopify — HMAC-SHA256 of the body, base64-encoded, in X-Shopify-Hmac-Sha256.
• Slack — HMAC-SHA256 of v0:{timestamp}:{body}, in X-Slack-Signature as v0=....
• Twilio — HMAC-SHA1 of the target URL plus its form parameters sorted by key and concatenated (key1value1key2value2...), base64-encoded, in X-Twilio-Signature — this is why the Target URL field matters for Twilio specifically.
• SendGrid — an HMAC-based stand-in for its ECDSA event-webhook signature (the real scheme needs a key pair, not a shared secret).

Common uses

• Testing a webhook receiver's parsing logic before going live with a real integration
• Verifying your signature-validation code against a real, correctly-signed payload
• Building example payloads for documentation or onboarding
• Debugging what headers and body shape a specific event type actually sends

Privacy

This tool runs entirely in your browser. Your webhook secret and generated payloads are never uploaded to a server.