catchbin documentation

catchbin is a webhook inspector with persistence. You point a provider — Stripe, GitHub, Shopify, or anything that sends HTTP webhooks — at a permanent catchbin URL once. catchbin captures every webhook in the cloud, answers the provider immediately, and holds the event so you can inspect it, replay it, forward it to localhost, and find out exactly why a signature failed.

Why you’d want it

Two problems come up on every webhook integration, and catchbin exists to remove both.

• The URL keeps disappearing. Free inspectors hand you a URL that expires in a few days. When it expires, the endpoint you configured in Stripe or GitHub breaks and the history is gone. A catchbin URL is permanent — configure it once and never touch the provider config again.
• Failures are opaque. A webhook arrives while your laptop is asleep and it’s gone. A signature check fails and the provider tells you nothing. catchbin captures the request whether or not your server is up, keeps it for the length of your plan’s retention window, and runs a provider-specific diagnostic when a signature does not verify.

catchbin does not sit in front of your production backend, own retries, or guarantee delivery. It captures, stores, inspects, and replays. That is the whole product.

Who it’s for

catchbin serves two developer profiles, and many people are both at once:

• Webhook consumers — you receive events from a provider and need to see what actually arrived and why your handler rejected it.
• Webhook senders — you build a service that fires webhooks to your own customers and need to assert, in tests, that the right payload and signature went out. See Test webhooks in CI.

Start here

QuickstartCapture your first webhook and forward it to localhost in five minutes.

Install the CLIHomebrew, curl installer, or a GitHub release, then authenticate.

ConceptsEndpoints, events, workspaces, replay, and signatures.

Verify signaturesHow diagnoses a failed signature and names the cause.

Provider guides

Match your symptom to a cause and jump to the fix.

StripeSignature failures, whsec_ vs sk_, body mutation, rotation, clock skew.

GitHubX-Hub-Signature-256, secret mismatch, the GitHub App single-URL limit.

ShopifyX-Shopify-Hmac-SHA256, the base64 HMAC scheme, wrong secret.

Other providersNot listed? The Generic provider verifies any HMAC-SHA256 hex signature — header, prefix, done.