Skip to main content
Create an endpoint, send its ingest URL a request, and see the captured event — in a few minutes. No provider setup, no receiver to stand up. Once the loop works, the sections below turn the toy into something real.
1

Get an API key

Create a whk_ API key in your dashboard under Settings → Credentials, then export it:
Prefer not to manage a key? wbhk login signs the CLI in over browser OAuth — see authentication.
2

Install an SDK

Skip this step if you’re using the CLI or curl.
3

Create an endpoint

Each endpoint has a permanent, signed ingest URL on wbhk.my. It’s returned here and stays visible (and re-revealable) in your dashboard — it never expires, and changes only if you rotate it.
4

Send it a test event

Point a provider at the ingest URL, or just POST to it yourself — no key required to send. The ingest URL accepts every verb; a write is captured and acknowledged with 200.
5

Watch it arrive

The request is now a captured event. List the endpoint’s events — the SDK iterators auto-paginate over the cursor:
You’ll see your {"hello":"webhook.co"} event with verificationState: unattempted — captured, but unsigned until you register a provider secret. That’s the whole loop: land, capture, inspect.

Verify it’s really from your provider

unattempted means nobody checked the signature yet. Register the signing secret your provider issued and, from the next request on, webhook.co verifies every inbound request against the exact bytes it captured — no verification code on your side — and stamps each event verified, authenticated, or failed.
Filter by state to confirm setup — an all-unattempted stream means the secret isn’t registered yet. Full walkthrough: verify inbound signatures.

Replay it to your machine

The events are already captured, so you don’t need a tunnel or a public URL to develop against them. Point wbhk listen at a loopback target and each event is re-delivered to your handler:
The cursor advances only after your local handler returns 2xx, so a crash or a sleeping laptop re-reads the un-acked events on the next run instead of dropping them. Capture a real payload once, then replay it as many times as you like while you iterate. More: replay to localhost.

Troubleshooting

  • Event not showing up? Check you POSTed to the exact ingest URL (token and all) and used a write verb — a GET is treated as a liveness probe and isn’t captured. Confirm the request came back 200.
  • verificationState: unattempted is expected until you register a provider secret. It’s not an error; it just means no signature was checked.
  • 401 on the API but the ingest works? Sending to wbhk.my needs no key; the API at api.webhook.co needs your whk_ bearer. See authentication.

What next

Deliver to a destination

Forward events to an allowlisted target with retries and optional signing.

Agent triggers

Have an MCP agent poll triggers.wait and act on everything the endpoint captures.

Verify inbound signatures

Register a provider secret so events arrive verified.

Browse providers

144 providers with their exact scheme, header, and handshake behaviour.