Inspect Stripe webhooks (no Stripe CLI needed)

The Stripe CLI is great for forwarding events to localhost, but sometimes you want the other view: what does Stripe actually send over the wire to a public endpoint — exact headers, exact body, retry behaviour? A capture URL shows you.

1. Get a capture URL

$ curl https://catchhook.catchhook.workers.dev/new

2. Add it as an endpoint in Stripe

Dashboard → Developers → Webhooks → Add endpoint (use test mode). Paste your https://catchhook.catchhook.workers.dev/h/… URL and pick some events, e.g. payment_intent.succeeded. Stripe shows the endpoint's signing secret (whsec_…) — copy it.

3. Trigger an event and inspect it

Create a test payment (or use the dashboard's "Send test event"). In your bin you'll see the full event JSON pretty-printed, plus the Stripe-Signature header with its t=…,v1=… parts.

4. Verify the signature

In bin settings, choose Stripe as the signature scheme and paste the whsec_… secret. Each capture gets a ✓/✗ badge computed the way Stripe documents it: HMAC-SHA256(secret, t + "." + raw body) compared against v1.

Gotcha: the whsec_ prefix is part of the identifier, not the key — CatchHook handles this, but in your own code strip nothing; pass the whole whsec_… string to Stripe's SDK helper (stripe.webhooks.constructEvent) and it does the right thing.

5. Test your retry handling

Stripe retries failed deliveries with backoff for up to 3 days. Set your bin's response status to 500, trigger an event, and watch the retries arrive on their real schedule. When your real handler is ready, replay any captured event to it.

← All guides · Docs · CatchHook vs webhook.site