Test webhooks locally, every signature checked
A webhook in Short Leash is a public HTTPS address that checks each delivery's signature and forwards it to your local site. When a check fails, Short Leash says why; hold deliveries, resend them, or save one as a test fixture.
Webhooks are part of Short Leash Pro. Every Pro feature is on for your first 14 days. Pricing
A Stripe delivery reaches Short Leash's Webhooks screen and fails its signature check. Short Leash says why: the event is from live mode, so it needs the live endpoint's secret. After the secret is changed, Check again verifies it. Then Hold deliveries goes on, Stripe's second attempt arrives and is held, and Release sends it on to northwind.test, which answers 200 in 46 ms.
Seven providers, checked before your app sees them
Short Leash checks Stripe, GitHub, Shopify, Slack, Standard Webhooks, Paddle and Lemon Squeezy signatures, plus any HMAC scheme you describe. Each delivery's Signature tab shows the scheme, the header, the timestamp's age and the signature Short Leash expected beside the one that arrived.
When a check fails, it says why and what to do. After you change the secret, Check again checks the delivery as of when it arrived.
- Generic HMAC: your header, algorithm, encoding and prefix
- Secrets live in secrets/webhooks.json, never in config.toml
- A random address with no account, or one on your domain
Hold, answer and resend
Hold deliveries answers the provider straight away and keeps each delivery while your site is down or you change its code. Release sends one on; Release all sends every held one, oldest first.
Answer with replies with a status, body and wait of your choosing instead of your app's reply. Its presets, 500 error, Time out after 30 s and 410 Gone, show how a provider retries. Retries of one event show as Attempt 2, Attempt 3 and so on.
- Resend signs afresh, so a timestamp is never too old
- Each forwarded delivery also shows on Requests
From a delivery to a test
Save as fixture writes a delivery's headers and body into the site's folder for your tests, and never overwrites a file. Copy as cURL and Open as call send it again your own way.
Send test event fires a delivery from a template, signed Valid, with a Wrong secret, an Expired timestamp or Unsigned, so you can check your handler refuses the bad ones.
From your terminal and your assistant
The leash command
leash webhook listleash webhook deliveries stripe -fleash webhook release stripeEvery command is in the CLI reference.
Tools your coding assistant can use
Connect Short Leash once with claude mcp add --scope user leash -- leash mcp; Settings › Coding assistants (MCP) has the setup for other assistants. Coding assistants
Questions
How do I test Stripe webhooks on localhost?
Create a webhook in Short Leash with Stripe's signing secret and your site's path, such as northwind.test and /stripe/webhook. Paste its address into Stripe. A random address needs no account; your own domain keeps one address across restarts.
Why does my Stripe webhook signature fail?
Each Stripe endpoint has its own signing secret, and stripe listen uses another. Short Leash's Signature tab shows the signature it expected next to the one that arrived and says which secret to use, including when a live-mode event meets a test-mode secret.
Can I replay a webhook after fixing my code?
Yes. Resend sends the same body to your sites again, signed afresh with the current secret, and Edit and resend lets you change it first.
Is a public webhook address safe to leave running?
Every delivery passes Short Leash's access rules, and Reject deliveries that fail the signature check answers 401 so your app never sees them. Signing secrets stay in a file only your account can read.
Start free, try Pro for 14 days
Download Short Leash for Mac or Windows. Every Pro feature is on for your first 14 days, with no card and no account.