1
Get an API key
Create a Prefer not to manage a key?
whk_ API key in your dashboard under Settings → Credentials, then export it:wbhk login signs the CLI in over browser OAuth — see authentication.2
Install an SDK
Skip this step if you’re using the CLI or curl.
3
Create an endpoint
Each endpoint has a permanent, signed ingest URL on
wbhk.my. It’s returned here and stays visible (and re-revealable) in your dashboard — it never expires, and changes only if you rotate it.4
Send it a test event
Point a provider at the ingest URL, or just
POST to it yourself — no key required to send. The ingest URL accepts every verb; a write is captured and acknowledged with 200.5
Watch it arrive
The request is now a captured event. List the endpoint’s events — the SDK iterators auto-paginate over the cursor:You’ll see your
{"hello":"webhook.co"} event with verificationState: unattempted — captured, but unsigned until you register a provider secret. That’s the whole loop: land, capture, inspect.Verify it’s really from your provider
unattempted means nobody checked the signature yet. Register the signing secret your provider issued and, from the next request on, webhook.co verifies every inbound request against the exact bytes it captured — no verification code on your side — and stamps each event verified, authenticated, or failed.
unattempted stream means the secret isn’t registered yet. Full walkthrough: verify inbound signatures.
Replay it to your machine
The events are already captured, so you don’t need a tunnel or a public URL to develop against them. Pointwbhk listen at a loopback target and each event is re-delivered to your handler:
2xx, so a crash or a sleeping laptop re-reads the un-acked events on the next run instead of dropping them. Capture a real payload once, then replay it as many times as you like while you iterate. More: replay to localhost.
Troubleshooting
- Event not showing up? Check you
POSTed to the exact ingest URL (token and all) and used a write verb — aGETis treated as a liveness probe and isn’t captured. Confirm the request came back200. verificationState: unattemptedis expected until you register a provider secret. It’s not an error; it just means no signature was checked.401on the API but the ingest works? Sending towbhk.myneeds no key; the API atapi.webhook.coneeds yourwhk_bearer. See authentication.
What next
Deliver to a destination
Forward events to an allowlisted target with retries and optional signing.
Agent triggers
Have an MCP agent poll
triggers.wait and act on everything the endpoint captures.Verify inbound signatures
Register a provider secret so events arrive
verified.Browse providers
144 providers with their exact scheme, header, and handshake behaviour.