hookpeek

A self-hosted webhook inspector. See exactly what a webhook sends — headers, body, query params — in real time, without a third party seeing your payloads. Zero dependencies.

The problem

Building any integration — Stripe, GitHub, Twilio, a payment provider, an internal service — eventually comes down to: "why isn't my webhook firing?" or "what did it actually send?" The usual fix is a hosted request-bin service, which means pointing real (sometimes sensitive) payloads at a third party, and often hitting a rate limit right when you need it most.

hookpeek runs entirely on your own machine or your own server. Nothing leaves it.

Install

npm install --save-dev hookpeek

Or run it without installing:

npx hookpeek

Usage

npx hookpeek

✓ hookpeek is running on http://localhost:4000

  Viewer:            http://localhost:4000/b/DKbS8BeJ
  Send webhooks to:  http://localhost:4000/i/DKbS8BeJ

Open the viewer URL in your browser, point your webhook at the capture URL,
and requests will appear live.

Open the viewer URL in a browser, point the provider's webhook config (or a curl/Postman request) at the capture URL, and it shows up within about 2 seconds — method, headers, query params, and body, all inspectable per request.

Custom port:

npx hookpeek --port 8080

Need a second, independent inspection URL? Visit http://localhost:4000/ again — it creates a fresh bin and redirects you to its viewer.

Using it with a real external provider (e.g. Stripe, GitHub)

localhost isn't reachable from the internet, so if you need a real third-party service to deliver webhooks to you (rather than testing locally with curl), run hookpeek on a small public server or VM instead of your laptop, or tunnel it with a tool like ssh -R or your preferred tunneling tool. hookpeek doesn't include a built-in tunnel — that's a separate, orthogonal problem, and plenty of good tools already solve it.

What's captured

For every request to /i/<bin-id>, regardless of HTTP method:

• Method and path
• Query parameters
• All headers
• Raw body (capped at 1MB — larger bodies are truncated, noted as such)
• Sender IP
• Timestamp

Bodies are stored as raw text, not parsed — so it works for JSON, form-encoded, XML, or anything else a webhook might send.

Data lifecycle

Everything is stored in memory only — nothing is written to disk, and a restart clears everything. This is by design: hookpeek is a debugging tool for active development, not a permanent request log. Bins with no activity for 24 hours are automatically cleaned up so a long-running instance doesn't grow without bound. Each bin also keeps only the most recent 200 requests.

Why this exists

Hosted request-bin tools are convenient but mean sending your payloads to someone else's server, and free tiers often rate-limit exactly when debugging gets intense. hookpeek is the same idea, self-hosted, with no account, no third party, and no rate limit beyond your own machine's resources.

Built by Cybergeon Technologies.

License

MIT © Cybergeon Technologies — see LICENSE.