WebhookMon Changelog

Added

• Delete events. Right-click an event, or select one or several and press Delete, to remove them from this Mac along with their delivery history; "Delete All Events…" in the same menu clears an endpoint. Each asks first, because the relay keeps no copy of an event your Mac has collected.
• Ask for a provider. An event from a sender WebhookMon has no signature check for now offers "Request a provider…" on its Signature tab, as do an endpoint's settings and the Help menu. Each opens the request form in your browser; the app itself sends nothing, and nothing from your webhooks is included.
• Help › WebhookMon Help opens the help page on the website.

Fixed

• A replay or a sample event that nothing answered (no server listening at the target, or the connection refused) now says so under the event list. Before, only the status column and the Replays tab showed it.
• "Set up target…" after creating an endpoint opens the settings with the cursor in the local target field.

The first release.

• A public relay URL for each endpoint, live the moment you create it, to paste into Stripe, Polar, GitHub, Shopify or Slack once. Up to ten endpoints per account, on up to three Macs signed in with the same email.
• The relay cannot read your webhooks: every event is sealed with HPKE to your Macs' own keys before it is stored, and deleted once your Mac collects it or after 24 hours. Events that arrive while your Mac is asleep or offline wait there and arrive in order when it reconnects; if any were dropped or expired meanwhile, WebhookMon says how many and why.
• The hosted relay is included with your license for development and testing: up to 5,000 events a day per account, all endpoints together, and 300 a minute per endpoint. It is not meant for production traffic. Settings shows how many events the relay received for your account today. WebhookMon says at least how many deliveries were refused over an endpoint's limit, and when your account reached its daily limit.
• An endpoint that no Mac has connected to for 30 days is paused: the relay refuses deliveries to it and keeps nothing until a Mac connects again. WebhookMon then says it was paused and that the provider may have disabled the webhook.
• Every event in full: body (pretty JSON or raw, form bodies decoded), headers as received, and the local response. Search by event type, id or provider, and filter by type and verdict.
• A plain-English signature verdict for Stripe, Polar (and other Standard Webhooks senders), GitHub, Shopify and Slack that tells a wrong secret apart from a stale timestamp and a malformed header. Add a provider's signing secret in the endpoint's settings and earlier events are verified again on the spot. Secrets stay in your Keychain.
• Forwarding to a server on your Mac, such as http://localhost:3000/webhooks, with the status, headers, body and timing of each response recorded next to the event. Forwarding can be turned on and off per endpoint, in the window or from the menu bar.
• Replay any event byte for byte, re-signed with the current timestamp so Stripe, Polar and Slack do not reject it as stale, to a different target, or with an edited body. Replay several selected events in order. Pick two deliveries of an event and diff their responses.
• Send a sample event for any of the five providers to try a local handler without the provider.
• Copy an event as a summary for a bug report, or as a curl command. Tokens and credentials in bodies and headers are masked on screen until you reveal them, and copying the unmasked curl command warns the first time.
• A menu bar icon with the unread count, and a menu listing each endpoint with its connection state, a forwarding switch and its relay URL.
• Reconnects on its own after sleep and when the network changes. Quitting waits a few seconds for forwards already under way, so their responses are recorded.
• How long captured events are kept on your Mac, by age and by count, in Settings and per endpoint.
• 14-day unrestricted trial. After it ends, captured events, headers and verdicts stay readable; creating endpoints, forwarding and replaying need a license.