Source URLs

A Source URL is a webhook test URL. Creating one gives you a URL you can hand to a provider straight away, with no account.

Creating a Source URL

Open inspect.hookdeck.com and a Source URL is created for you. When you come back in the same browser, you go straight to it.

To make another, choose New in the sidebar. A Source URL per provider you're testing is a common way to work, so a Stripe payload and a Shopify payload don't land in the same list. New Source URLs are named source, source-1, and so on; you can rename them.

Source URLs can also be created with the Inspect API, with no account and no API key, which is how you'd create one inside a test or from an AI agent:

curl -sS -X POST "https://inspect.hookdeck.com/"

The reply has the new Source URL as ingest_url, and its page as inspect_url. See the Inspect API reference.

The Source URL and its page

Each Source URL comes with a page, and they do different jobs:

  • The Source URL (inspect.hookdeck.com/e/<id>) is where requests arrive. This is the one you give to the service sending them. Anything after it, such as /e/<id>/webhooks?shop=1, is kept as the request's path and query string.
  • Its page (inspect.hookdeck.com/<id>) is where you read them. This is the one you keep open.

Opening the Source URL itself in a browser takes you to its page rather than capturing a request.

Setting a Source Type

A Source URL is a generic WEBHOOK one unless you give it a Source Type naming a platform, such as STRIPE or SHOPIFY. You can set it in three ways:

  • On the home page, choose the platform before the Source URL receives its first request.
  • Open the platform's page, such as inspect.hookdeck.com/webhooks/shopify.
  • Send {"type": "SHOPIFY"} as the JSON body when you create a Source URL with the Inspect API. Types are upper case and must match exactly.

A Source Type doesn't restrict who can send to the Source URL: a request you send by hand is captured like one from the platform. It does change four things:

  • HTTP methods. The Source URL accepts only the methods that platform sends, which is POST for most. See supported HTTP methods.
  • The Webhook Library opens on that platform's samples. See Webhook Library.
  • URL checks. Zoom, X, eBay, LinkedIn, Smartcar, Xero and Exact Online check the URL before they'll send anything. A Source URL of their type answers the check, once you've saved the values Inspect asks for when you choose the platform.
  • Signature checks, for the platforms that support them in Inspect. See below.

Verifying signatures

For some platforms, including Zoom, Zendesk, Sanity, Wix, Xero, Aircall and Cloudinary, Inspect shows fields for the platform's signing secret when you choose it. Once you save the secret, Hookdeck checks the signature of every request. A request that fails is still captured, and marked Rejected with the reason.

Most platforms, including Stripe and Shopify, have no secret field in Inspect, so their requests aren't verified. To verify every request before it's accepted, configure authentication on a source in an Event Gateway project.

Supported HTTP methods

Source URLs accept GET, POST, PUT, PATCH, and DELETE.

That matters because not every provider sends POST. A Source URL captures a GET webhook the same as any other request, and a body sent with GET or DELETE is captured too.

A Source URL with a Source Type accepts only the methods its platform sends: POST for most platforms. A request with another method is answered 405 and still captured, marked Rejected, so you can see what was sent.

Renaming and deleting Source URLs

Open the settings beside a Source URL in the sidebar.

  • Source URL Name renames it. Names can use letters, digits, - and _; spaces become -.
  • Delete Source URL deletes it at once, with no confirmation. Its page and its requests can no longer be read, and it can't be undone.

Who can access a Source URL

Source URLs are not private. Knowing a Source URL's link is the only thing that grants access to it. Anyone with the link can send requests to it, read every request it has captured, and open it in Inspect to make changes to it.

That's what makes a Source URL shareable: send the link to a colleague and you can both watch the same requests arrive, with nothing to configure.

It also means you should treat the link like a key and keep it out of anywhere public. Don't send a Source URL anything you wouldn't want anyone holding the link to read, and don't point production traffic at one.

If you want private sources, use an Event Gateway project. Nothing in it is visible until you add team members to the project yourself.

Retention and Hookdeck accounts

Without an account, your Source URLs are kept together by your browser's session. It's held in a cookie that lasts 90 days from the first visit and isn't extended when you come back. Captured requests are kept for 3 days.

A Source URL's link keeps working after the cookie expires.

Choosing Save Data creates a free Hookdeck account, with GitHub, Google, or an email and password. The Source URLs you've already made carry over as they are, along with the requests they've captured, and become available across sessions and devices.

Request list limit

The request list shows the latest 250 requests for a Source URL. To read further back, page through its requests with the Inspect API.

<- Previous Overview Next -> Inspecting requests