Skip to main content
webhook.co gives you a free, permanent, signed ingest URL: point any provider at https://wbhk.my/<token> and every request is captured — raw bytes first, then verified and deduplicated — where you can inspect it, replay it to localhost with one command, and deliver it onward. It starts as a debugging mailbox and grows, without a rewrite, into a full inbound pipeline (verify → dedup → retry → replay) plus outbound delivery. Every capability is reachable identically from the CLI, API, dashboard, and MCP, and nothing is public unless you make it so.

​
The problem it removes

Receiving a webhook is deceptively involved. To do it properly you need, at minimum:
  • A public URL the provider can reach — which your laptop doesn’t have, so local development means tunnels, redeploys, or a staging box.
  • Signature verification done right: over the raw bytes, constant-time, per provider — the single most common thing people get subtly wrong.
  • Retries with backoff on the way out, plus dead-lettering, so a receiver blip doesn’t drop events on the floor.
  • A way to replay a payload you’ve already seen — to fix a handler, or recover from an outage — instead of asking the provider to re-send.
webhook.co is the piece that owns all four. You get the URL for free, verification is a registered secret rather than code you write, retries and dead-lettering are built into delivery, and every captured request is replayable forever.

​
The mental model

Every request follows one path: ingest → verify → dedup → store → deliver → replay. Capture is the floor — the raw bytes are written down the instant a request arrives, and everything after runs against that durable copy. A bad signature, an unknown provider, or a downstream outage can never cost you the event; it only changes what happens next. See how webhook.co works for the diagram and a step-by-step walk.

​
What you can do

Four capabilities, each useful on its own. Start wherever your problem is.

Ingest

A permanent, signed URL on a dedicated, cookieless apex. It accepts every HTTP verb, answers provider verification handshakes automatically, and captures raw bytes durably before it verifies or dedupes — so a request is never lost at the door.

Verify

Register a provider’s signing secret and every inbound request is checked against the exact bytes captured — no verification code on your side. Each event carries a verificationState (verified / authenticated / failed / unattempted), with 141 providers built in from a single registry.

Deliver

Forward events to an SSRF-safe destination allowlist with at-least-once delivery, a fixed exponential retry schedule, and dead-lettering. Outbound signing follows Standard Webhooks and is verified-gated — webhook.co only re-signs what it authenticated.

Trigger an agent

Over MCP, an agent calls triggers.wait to consume the webhooks captured for it since its last cursor — verified, in order, at-least-once, and held even while the agent is offline. It returns what’s landed plus a cursor to resume, so your agent reads one durable subscription instead of polling each provider’s API.

​
One product, four surfaces

The CLI, API, dashboard, and MCP aren’t four products that happen to overlap — they’re four bindings over one capability contract, with one shared handler per capability. A capability that exists on one exists on all, with the same request shapes and the same results. Script it in CI, click it in the dashboard, or hand it to an agent without learning four different tools — and nothing drifts, because there’s a single definition behind each. Listing your endpoints is the same operation everywhere:

​
Standard Webhooks, private by default

Signing and verification follow the Standard Webhooks spec on both the receive and send sides, so the signatures you check and the ones webhook.co emits are the same well-specified format — not a bespoke scheme. And ingestion lives on its own cookieless apex that carries no session and answers no CORS: an ingest URL is a mailbox, not an app, and an unknown token gets a flat 404 that reveals nothing. Nothing you capture is visible to anyone but your org.

​
Get started

Quickstart

Create an ingest URL, send a test event, and watch it arrive — in a few minutes.

How it works

The path a webhook takes: ingest → verify → dedup → store → deliver → replay.

​
Explore

Ingest URLs

What the wbhk.my apex does, why every verb is accepted, and how reveal and rotation work.

Verify inbound signatures

Register a provider secret and read the four verification states off your events.

Deliver and retry

Destinations, the retry schedule, the SSRF guard, and verified-gated send-side signing.

webhook.co over MCP

21 scope-gated tools over streamable-HTTP, including the webhook → agent trigger.

​
The API

The REST API lives at https://api.webhook.co. It’s a small, predictable surface — every endpoint is described by a machine-readable OpenAPI 3.1 document you can browse in the API reference or fetch yourself:
That same document generates the SDKs and this site’s reference, so they never drift from the running API. Authentication is a whk_ bearer key — see authentication.

​
SDKs

Official, typed SDKs in three languages — each with the same hardening built in: bearer auth, bounded retries with jitter, cursor pagination, idempotency, and secret redaction.

TypeScript

npm install @webhook-co/sdk

Python

pip install webhook-co

Go

go get github.com/webhook-co/webhook-go

​
Built for agents, too

These docs are readable by your coding agent. Point it at docs.webhook.co/mcp to search them over MCP, or use the Copy page menu to drop any page into ChatGPT, Claude, or Cursor.