Integrations · Interactive Tools
HookScope is the self-hosted webhook receiver I built in Python and FastAPI. It verifies every signature, stores every delivery (including the rejected ones), forwards events with retries, and lets you replay or reshape them. This page runs a working model of it in your browser, so you can send real signed requests, break them on purpose and watch what happens. It models GitHub, Stripe and generic senders; the signature lab covers Slack, Shopify, Twilio and Svix.
Pick a provider and a failure mode, then send. The signature is computed with real HMAC-SHA256 in your browser and checked the same way HookScope's signatures.py checks it.
Send a webhook to see the request.
-
Rejected deliveries get a 401 but are still stored, so you can see why they failed. Accepted ones get a 202 straight away and are forwarded in the background.
Every delivery lands here. Select one to see its headers, the forwards it triggered, and to preview a payload transform against it. The first three are example deliveries.
| # | Source | Type | Signature |
|---|
Supports $, .key, ['key'], [n], wildcards [*] / .*, recursive descent .., and metadata like @source, @event_type, @event_id. The real app also supports [?(...)] filters.
The same shape as HookScope's HOOKSCOPE_RULES file. The demo targets are simulated: billing is flaky, warehouse is down.
A small FastAPI service with one pure function per provider, a thin SQLite store, and forwarding that runs after the provider has its answer.
Each verifier is a pure function that never raises. A malformed or missing header becomes an invalid or unsigned result with a reason, stored next to the payload, instead of a stack trace.
Matched rules run after HookScope has answered the provider. Transient failures (no response, 408, 425, 429, 5xx) retry with exponential backoff that honours Retry-After. Anything still failing becomes a dead letter you can re-send.
Rules can post a readable Slack summary or a new JSON document built with JSONPath mappings, including wildcards, recursive descent and filter expressions, with a preview against any stored event.
An app factory lets tests inject a temporary database, secrets, an HTTP client and a fake clock. Every push runs ruff and pytest in GitHub Actions, and a Dockerfile ships it.
The sample payloads are illustrative test data, the secrets are public demo values, and the forwarding targets are simulated. This page models the backend in your browser, so nothing you type leaves it. HookScope is MIT licensed.