Documentation

Overview

Payloader is a webhook inspection and testing platform. Point any service's webhook URL at Payloader and instantly see every incoming payload: parsed, summarized, and ready to debug.

Unlike generic webhook catchers, Payloader recognizes 18 platforms and translates raw JSON into human-readable summaries. A Stripe payment_intent.succeeded event becomes "Payment of $149.00 succeeded for customer@email.com".

Quick Start

Get your first webhook captured in under a minute.

1. 1

   Create an account

   Sign up at payloader.dev/accounts/register. Every account starts on the Free plan. No credit card required.

2. 2

   Create an endpoint

   From the dashboard, click Create Endpoint. Give it a name and Payloader generates a unique URL like:

   https://hook.payloader.dev/h/a1b2c3d4e5f6

3. 3

   Point your service at it

   Copy the endpoint URL and paste it into Stripe, GitHub, Shopify, or any service that sends webhooks. You can also test it immediately:

   curl -X POST https://hook.payloader.dev/h/a1b2c3d4e5f6 \
     -H "Content-Type: application/json" \
     -d '{"event": "test", "message": "Hello Payloader!"}'

4. 4

   Watch it arrive

   The webhook appears in your live feed instantly. Click it to see full headers, body, platform detection, and an intelligent summary.

Core Concepts

Creating Endpoints

From the dashboard, click Create Endpoint and give it a descriptive name (e.g., "Stripe Production", "GitHub Staging"). Payloader generates a unique 12-character slug and your webhook URL is ready immediately.

Each endpoint can be independently:

• • Toggled on/off: paused endpoints still capture webhooks but mark them as received while inactive
• • Renamed: change the display name anytime without affecting the URL
• • Deleted: permanently removes the endpoint and all its captured requests

Receiving Webhooks

Payloader accepts webhooks sent with any HTTP method (GET, POST, PUT, PATCH, DELETE). The receiver captures:

• • HTTP method and path
• • All request headers
• • Query parameters
• • Request body (up to 5 MB)
• • Remote IP address
• • Precise timestamp

After capture, the receiver immediately returns your configured response (default: 200 OK with {"received": true}) and queues the webhook for intelligence processing.

Testing with cURL

# Simple POST
curl -X POST https://hook.payloader.dev/h/your-slug \
  -H "Content-Type: application/json" \
  -d '{"test": true}'

# Simulate a Stripe webhook
curl -X POST https://hook.payloader.dev/h/your-slug \
  -H "Content-Type: application/json" \
  -H "Stripe-Signature: t=123,v1=abc" \
  -d '{"type": "payment_intent.succeeded", "data": {"object": {"amount": 5000}}}'

Custom Responses

Configure what Payloader sends back to the webhook sender. This is useful when a service expects a specific response format or status code.

Navigate to your endpoint's Response tab to configure:

HMAC Verification

HMAC signature verification lets you confirm that incoming webhooks are authentic. When configured, Payloader verifies the signature in the specified header using your shared secret.

Navigate to your endpoint's HMAC tab and configure:

Once configured, every request detail page shows a verification badge: verified, failed, or not checked.

Live Feed

Each endpoint has a real-time live feed powered by Server-Sent Events (SSE). When a webhook arrives, it appears instantly in your dashboard. No page refresh or polling needed.

New webhooks slide in with a brief animation and flash, making it easy to spot incoming events while you work. The feed shows:

• • Platform badge (Stripe, GitHub, etc.)
• • Intelligent summary
• • Relative timestamp
• • HTTP method

Click any entry to view the full request details.

Global feed

The global feed shows webhooks from all endpoints in your workspace in a single stream. Access it from the Feed link in the dashboard sidebar. This is useful for monitoring all your integrations at once without switching between endpoints.

Request Details

The request detail view shows everything captured about a webhook:

Payload Intelligence

Payloader automatically analyzes every incoming webhook and extracts structured information:

Search & Filter

Find specific webhooks across your endpoint's history using the search bar and filter dropdowns.

Filters can be combined. The same filters apply when exporting data, so you can export exactly the subset you need.

Bulk delete

Need to clear out old requests? Use the Bulk Delete action on the endpoint page to delete all requests matching a date range. Individual requests can also be deleted from the request detail page.

Replay

Replay lets you re-send a captured webhook to any URL. This is invaluable for debugging your webhook handler: capture the webhook once, then replay it against your local development server as many times as needed.

How to replay

1. 1. Open any captured request detail page
2. 2. Click Replay
3. 3. Enter the target URL (must start with http:// or https://)
4. 4. Click Send

Payloader sends the original request body, headers, and method to your target URL and captures the response. You can see the response status code, headers, and body on the replay result page.

Each request keeps a history of all its replays, so you can track debugging progress.

Diff & Compare

Compare two webhook payloads side-by-side to spot differences. This is useful when a webhook starts failing and you need to see what changed between a working and broken payload.

How to compare

1. 1. Navigate to your endpoint's Diff tab
2. 2. Select Request A and Request B from the dropdowns
3. 3. Click Compare

The comparison view shows both payloads with pretty-printed JSON, platform badges, event types, and timestamps, which makes it easy to spot structural differences.

Export

Export captured webhook data in four formats. Exports respect any active search filters, so you can export exactly the data you need.

Exports are capped at 500 requests. Use date range filters to narrow your export if you have more data.

Analytics

The analytics dashboard gives you a high-level view of webhook traffic for any endpoint.

Forwarding

Automatically forward captured webhooks to up to 5 destination URLs. This lets you use Payloader as a proxy: inspect webhooks in the dashboard while also delivering them to your applications in real time, even when the sender only accepts one webhook URL.

Configuration

Navigate to your endpoint's Forwarding tab to configure:

Forwarding filters

Only forward webhooks that match specific criteria:

• Platform filter: forward only from specific platforms (e.g., Stripe, GitHub)
• Event type filter: forward only specific events with wildcard support (e.g., charge.*)
• HTTP method filter: forward only specific methods (e.g., POST only)
• HMAC filter: forward only requests with valid HMAC signatures

Forwarding results

Each forwarding attempt logs the destination's response status, headers, body, and duration. The request detail page lists every destination the request was sent to with its latest result. When some destinations accepted a request and others did not, it is marked as partly delivered.

If a forward fails or you need to resend, click Resend beside a destination on the request detail page, or Send to all again to forward the request to every current destination.

Notification Rules

Get alerted when specific webhooks arrive. Each endpoint can have multiple notification rules, each with its own channel, destination, and optional filters.

Navigate to your endpoint's Notifications tab to create and manage rules. Each rule can be independently toggled on/off.

A notification log tracks the history of all sent alerts, including delivery status and any errors.

Notification Channels

Notification Filters

Avoid noise by filtering which webhooks trigger a notification:

• • Platform filter: only notify for a specific platform (e.g., only Stripe webhooks)
• • Event type filter: only notify for event types matching a substring (e.g., payment matches payment_intent.succeeded)

Filters can be combined. Leave both blank to get notified on every webhook.

Webhook payload and signature

A webhook notification is a POST with a JSON body. It is sent once per matching event, times out after 10 seconds, and any reply other than 2xx is recorded as a failure in the notification log.

{
  "type": "payloader.event",
  "id": 18241,
  "received_at": "2026-09-23T14:14:07Z",
  "platform": "stripe",
  "event_type": "invoice.paid",
  "summary": "Invoice paid: $19.00 from rosa@tidewaterbooks.com",
  "fields": { "total": "19.00", "id": "in_1Q8rTZ2eZvKYlo2C" },
  "endpoint": {
    "slug": "k3m9q2x7p4ra",
    "name": "Stripe production",
    "url": "https://hook.payloader.dev/k3m9q2x7p4ra"
  },
  "dashboard_url": "https://payloader.dev/dashboard/requests/18241/"
}

Every request carries two headers: Payloader-Event-Id (the same as id) and Payloader-Signature, which looks like t=1790172847,v1=5257a8....

To check a request came from Payloader, compute an HMAC-SHA256 of the timestamp, a period, and the raw request body, using the rule's signing secret (shown under the rule on the Notifications page). Compare it to v1, and reject timestamps more than a few minutes old.

// Node.js
const crypto = require('crypto');

function isFromPayloader(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  const expected = crypto.createHmac('sha256', secret).update(parts.t + '.' + rawBody).digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  return fresh && typeof parts.v1 === 'string' && parts.v1.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}

Workspaces

A workspace is the top-level organizational unit in Payloader. All endpoints, requests, API keys, and notification rules belong to a workspace.

When you sign up, Payloader creates a "Personal" workspace automatically. You can rename it from Dashboard → Settings.

On Team and Business plans, you can invite team members to share access to all endpoints and requests in the workspace.

Multiple workspaces

You can create additional workspaces to separate projects or teams. Switch between workspaces using the workspace switcher in the dashboard sidebar.

Endpoints can be moved between workspaces you own. From the endpoint's settings, select Move to workspace and choose the destination. All request history moves with the endpoint.

Team Members

Manage team access from Dashboard → Members. Invite existing Payloader users by email address.

Roles

Plans & Billing

Every account starts on the Free plan, with no credit card and no end date. Free includes 1 user, 2 webhook URLs, 7 days of history, forwarding to 1 address per URL and up to 1,000 webhooks a month. Summaries, the live feed, resend, replay, export, the CLI, the API and alerts work on every plan. Signature checks and re-signing start on Developer.

Plans

Monthly webhook limit on Free

Past 1,000 webhooks in a month, the receiver answers 429 with a message to upgrade, and the sender retries later. The count resets on the 1st of each month (UTC). Paid plans have no monthly cap.

Canceled or unpaid subscriptions

If you cancel, or a payment fails and is not resolved, your account moves to the Free plan. Nothing is deleted. Your history keeps the retention it had, and the webhook URLs and forwarding addresses you already have keep working. You cannot add more than the Free limits allow until you pick a paid plan again.

Paid plans have a 30-day money-back guarantee. Pay yearly and get 2 months free.

Payments are processed securely through Stripe. Manage payment methods, view invoices, and cancel from Dashboard → Billing.

See the pricing page for a full feature comparison.

API Authentication

The Payloader REST API uses API keys for authentication. Create and manage keys from Dashboard → API Keys.

Creating an API key

1. 1. Go to Dashboard → API Keys
2. 2. Enter a name (e.g., "CI/CD", "Monitoring Script")
3. 3. Click Create. The raw key is shown once
4. 4. Copy and store the key securely

Using the API key

Include your key in the X-API-Key header:

curl -H "X-API-Key: pl_your_api_key_here" \
  https://payloader.dev/api/v1/endpoints/

Keys are stored as SHA-256 hashes. Only the first 10 characters (prefix) are visible after creation. You can revoke a key at any time, and it takes effect immediately.

Endpoints API

Manage webhook endpoints programmatically.

curl -H "X-API-Key: pl_..." https://payloader.dev/api/v1/endpoints/

curl -X POST -H "X-API-Key: pl_..." \
  -H "Content-Type: application/json" \
  -d '{"name": "Stripe Production"}' \
  https://payloader.dev/api/v1/endpoints/

curl -X PATCH -H "X-API-Key: pl_..." \
  -H "Content-Type: application/json" \
  -d '{"is_active": false}' \
  https://payloader.dev/api/v1/endpoints/a1b2c3d4e5f6/

Requests API

Retrieve and manage captured webhook requests.

# List all Stripe webhooks
curl -H "X-API-Key: pl_..." \
  "https://payloader.dev/api/v1/endpoints/a1b2c3d4e5f6/requests/?platform=stripe"

CLI Installation

The Payloader CLI lets you manage endpoints and inspect webhooks from the terminal. It's a single Go binary with no dependencies.

Download

Download the latest binary for your platform:

After downloading, make it executable and move it to your PATH:

          
$ chmod +x payloader-darwin-arm64
          
$ mv payloader-darwin-arm64 /usr/local/bin/payloader

CLI Authentication

Authenticate the CLI with your API key (generate one in Dashboard → Settings → API Keys):

          
$ payloader auth login
          
Base URL (e.g. https://payloader.dev): https://payloader.dev
          
API Key: pl_••••••••••••••••••••
          
Verifying credentials... ok
          
You are now authenticated.

Credentials are saved to ~/.payloader.json. Other auth commands:

• payloader auth status: check current authentication
• payloader auth logout: remove stored credentials

CLI Commands

Most commands have shorter aliases: endpoints → ep, requests → req. Subcommands also have aliases: list → ls, delete → rm, update → set.

Endpoints

          
$ payloader endpoints list              # List all endpoints (alias: ls)
          
$ payloader endpoints create "My Endpoint" # Create endpoint
          
$ payloader endpoints get <slug>         # Get endpoint details
          
$ payloader endpoints update <slug> --name "New Name" # (alias: set)
          
$ payloader endpoints delete <slug>      # Delete (alias: rm)
          
$ payloader ep delete <slug> --force     # Delete without confirmation

Endpoint Update Flags

The endpoints update command accepts the following flags:

          
# Configure forwarding with custom response
          
$ payloader ep set abc123def456 --forwarding --forwarding-url https://example.com/webhook
          
$ payloader ep set abc123def456 --response-status 201 --response-body '{"ok":true}'
          

          
# Set up HMAC signature verification (e.g. for Stripe)
          
$ payloader ep set abc123def456 --hmac-secret whsec_... --hmac-header stripe-signature --hmac-algorithm sha256

Requests

          
$ payloader requests list <slug>                   # Recent requests (alias: ls)
          
$ payloader requests list <slug> --platform stripe  # Filter by platform
          
$ payloader requests list <slug> --method POST      # Filter by method
          
$ payloader requests list <slug> --query "invoice"  # Search body/summary
          
$ payloader requests get <id>                       # Full request detail
          
$ payloader req rm <id>                             # Delete request

Account & Utilities

          
$ payloader account             # Show workspace info
          
$ payloader account rename "New Name"
          
$ payloader version              # Show version + check for updates
          
$ payloader update               # Download & install latest version

Listen & Forward to Localhost

The listen command connects to an endpoint's live stream and forwards each incoming webhook to a local URL. No tunnel (ngrok, cloudflared, etc.) required. Use --forward-to (or -f) to specify the target.

          
$ payloader listen <slug> --forward-to http://localhost:8000/webhooks/
          

          
Listening to endpoint "Stripe Production" (a1b2c3d4e5f6)
          
Forwarding to http://localhost:8000/webhooks/
          
Press Ctrl+C to stop
          

          
[14:32:01] POST /h/a1b2c3d4e5f6 (stripe) → 200 OK (12ms)
          
[14:32:15] POST /h/a1b2c3d4e5f6 (github) → 200 OK (8ms)
          
[14:33:42] POST /h/a1b2c3d4e5f6 → 201 OK (23ms)

How it works

1. 1. The CLI connects to the endpoint's server-sent events (SSE) stream via your API key
2. 2. When a webhook arrives, the full request data (method, headers, body) is streamed to the CLI
3. 3. The CLI forwards the request to your local URL, preserving the original method, headers, and body
4. 4. The response status and latency are printed to the terminal

Typical workflow

          
# 1. Start your local dev server
          
$ python manage.py runserver
          

          
# 2. In another terminal, start listening
          
$ payloader listen a1b2c3d4e5f6 -f http://localhost:8000/webhooks/stripe/
          

          
# 3. Point Stripe (or any service) at your Payloader endpoint URL
          
#    https://hook.payloader.dev/h/a1b2c3d4e5f6
          

          
# 4. Webhooks arrive in Payloader dashboard AND your local server

The connection auto-reconnects after 3 seconds if interrupted. Original headers are forwarded (except hop-by-hop headers like Host, Connection, etc.). Press Ctrl+C to stop.

Supported Platforms

Payloader detects and extracts intelligence from 18 webhook providers. Detection is based on headers, body structure, and known API patterns.

Webhooks from unrecognized platforms are still captured and displayed. You see the request exactly as it arrived.

Rate Limits

The webhook receiver enforces rate limiting to protect the service:

The REST API does not have rate limits. The receiver also enforces a 5 MB body size limit and a maximum of 100 headers and 100 query parameters per request.

Need higher rate limits or larger payload sizes? Contact support@payloader.dev to discuss your requirements.

Plan Limits