WebhookMon
Native macOS Webhook Debugger
Why did this webhook fail?
WebhookMon gives Stripe, Polar, GitHub, Shopify and Slack webhooks one stable public URL, shows every event with headers and body, and tells you in plain English whether a bad signature is a wrong secret or a stale timestamp. Forward events to your local server, record the response, and replay any event byte for byte or re-signed with a fresh timestamp.
macOS 14 (Sonoma) or later • 14-day unrestricted trial • No account beyond an email for the relay
How it works
A hosted relay, and why we can't read your webhooks.
Every one of these providers wants to POST to a public URL. WebhookMon runs on your Mac, which usually doesn't have one, so a small Cloudflare Worker takes the delivery for you at a stable address and pushes it down a WebSocket to the app.
The relay cannot read the event. Before it ever writes an event to storage, it seals it with HPKE to your Mac's public key. Only the private key on your Mac can open it. The relay never holds that key, so a captured database or a subpoena gets ciphertext, not your Stripe or Slack payloads.
It doesn't sit there long either. An event is deleted the moment your Mac acknowledges it, or after 24 hours if it never does. The relay keeps just enough account data to route events to your devices: your email, your device keys, hashed tokens, and endpoint names and counts. See the privacy page for the full list.
Three things you need when a webhook breaks
See it, understand it, replay it.
WebhookMon doesn't just forward events. It tells you why one failed and lets you send it again.
Plain-English signature verdicts
Every event is verified on arrival against the provider's actual signature scheme, not a guess. WebhookMon tells a wrong secret apart from a stale timestamp apart from a malformed header, in a sentence, not a stack trace.
- Stripe, Polar, GitHub, Shopify and Slack, each checked the way that provider signs.
- A stale timestamp says how old it was against the 5-minute tolerance.
- Each endpoint's settings take one signing secret per provider and say where that provider's dashboard keeps it. Secrets stay in your Keychain.
- No secret yet? Events still arrive and display, with a note to add one to verify.
Forward, replay, re-sign
Live events forward to your local server and the response is recorded next to them. Replay any event byte for byte, edit it first, or re-sign it with the current timestamp so Stripe, Polar and Slack don't reject it as too old.
- Every forward and replay keeps its status, timing and response body.
- Pick two deliveries and diff their responses to see what changed between a 400 and a 200.
- Headers are shown as received, with credential-looking values masked until you reveal them.
An encrypted relay you don't run
One relay URL per endpoint, live the moment you create it. No tunnel process to keep open, no session that dies when your laptop sleeps: events queue for up to 24 hours until your Mac reconnects.
WebhookMon lives in the menu bar: the icon shows the unread count, and the menu lists each endpoint with its connection state.
Simple, Transparent Pricing
Own it forever.
Includes 12 months of updates • Optional $15/year renewal to extend updates
- Use on up to 3 Macs
- Keeps working after the update window ends
- Stripe, Polar, GitHub, Shopify and Slack, no per-provider add-on
- 14-day fully unrestricted trial, one email for the relay
- 14-day no-questions-asked refund guarantee
After the trial, viewing captured events, headers and verdicts keeps working. Creating endpoints, forwarding and replay need a license.
The hosted relay is included with your license for development and testing, up to 5,000 events a day per account and 300 a minute per endpoint; it is not meant for production traffic.
Frequently Asked Questions
Everything you need to know.
Why not just use ngrok or the Stripe CLI?
Both forward events, and ngrok can replay a request as it was captured. The Stripe CLI can ask Stripe to resend one of its own events with a fresh signature (stripe events resend), but neither can re-sign a payload you captured or edited, and neither tells you why a signature failed. Polar, Shopify, Slack and GitHub have nothing equivalent. The Stripe CLI is also Stripe-only: stripe listen opens an outbound connection to Stripe and forwards its events to localhost only while it runs on that machine, and it signs them with the CLI's own whsec_ secret, not the one on your dashboard endpoint. WebhookMon's URL is yours to keep, works with all five providers, and buffers events while your Mac is asleep.
What does the relay store?
Ciphertext it cannot read, deleted once your Mac acknowledges it or after 24 hours. On the account side: your email, your devices' public keys, hashed tokens, and your endpoints' names and event counts. No IP addresses, no plaintext payloads. See the privacy page for the exact list.
What happens to events while my Mac is asleep?
The relay keeps holding them, sealed, for up to 24 hours (or until per-endpoint storage caps are reached). When your Mac reconnects, WebhookMon replays the backlog in order. If anything was evicted or expired before that, it tells you how many events and why.
Is there a limit on the relay?
Yes. The hosted relay is included with your license for development and testing: up to 5,000 events a day per account and 300 a minute per endpoint. It is not meant for production traffic. An endpoint that no Mac has connected to for 30 days is paused until one connects again; in the meantime the relay refuses deliveries to it and keeps nothing, and your provider may disable the webhook, so check its dashboard when you come back. We may suspend accounts that abuse the service.
Polar, Shopify and Slack don't have a forwarding CLI. Does WebhookMon still work?
Yes. WebhookMon's relay accepts events from any provider that can POST to a URL, which is all five. That matters most for Polar, Shopify and Slack, since they don't ship an equivalent to stripe listen, and the usual fallback is a generic tunnel with no signature verdict.
How many Macs can I use it on?
A license covers up to 3 Macs, matching the relay's device limit per account. Sign in with the same email on each one.
What's your refund policy?
14 days, no questions asked. See the refund policy.
Why is it not in the Mac App Store?
It's not a sandbox conflict this time. WebhookMon skips the App Store for the same reason the rest of the family does: selling directly through Polar keeps licensing simple, with self-serve activation and no review cycle every time the relay changes.