Stop Adding console.log to Production Just to See What a Webhook Sent
You've integrated a payment gateway, a CI provider, or a SaaS product that sends webhooks — and now something's not working. The payload isn't arriving the way the docs say it should, a header is missing, or the signature verification keeps failing. So what do you do? If you're like most of us, you reach for one of these: Add a console.log(req.body) and redeploy, just to see one request Spin up…
In the world of software development, integrating third-party services that send webhooks can often lead to headaches when something goes wrong. You might receive a webhook, only to find that the expected data isn't arriving, a required header is missing, or the signature verification keeps failing. The initial instinct for many developers in such situations is to add a `console.log(req.body)` statement to their code and redeploy the application to see what the incoming request looks like.
Alternatively, they might spin up an ngrok tunnel to expose their local server to the internet or dig through their provider's dashboard to find any logs of raw payloads. They may also set a breakpoint and hope that the webhook fires again before giving up on the issue entirely. However, all of these methods involve unnecessary overhead and can disrupt the normal functioning of your application.
The real problem lies in the fact that webhooks are inherently invisible by default. Unlike normal API calls that you initiate, webhooks are events that are sent to you, and you have no control over the request. By the time the webhook reaches your server, your codebase has already likely assumed a specific structure for the payload.
If your assumptions are incorrect, you'll find yourself debugging blind, adding logging statements, redeploying the application, and waiting for the next event to fire, all while hoping for the best. This becomes even more challenging when dealing with signature verification (as in the cases of Stripe, GitHub, Shopify, etc.), third-party integrations where you can't add log lines on the sending side, or when working in a local development environment where the sender may not be able to reach your localhost.
To address these challenges, a tool called "Webhook / Request Bin" has been developed. This tool, available at samtoolkit.com, provides a simple and effective solution for debugging webhooks without the need for redeploying your code or setting up complex infrastructure. By creating a new bin, you're given a unique, disposable URL that acts as a temporary endpoint for receiving and displaying incoming requests.
Every request that hits this URL is captured and displayed in real-time, showing you the method, full headers, query parameters, and body of the request as it arrives. This allows you to see the exact data that the provider sent without having to modify your code or infrastructure. The typical workflow for using this tool involves creating a bin, obtaining a unique URL, pointing your webhook or integration at this URL, triggering the event that fires the webhook, and then inspecting the raw request to see what was actually sent.
This process can be particularly helpful in situations where signature/HMAC verification bugs occur, where the actual fields in the payload don't match what's documented in the provider's API, or when you need to build an integration before the backend route is ready. The browser-based nature of the tool also means that it can be used to debug not just webhooks, but any HTTP requests made by a client, a form submission, or a redirect, making it a versatile tool for any developer's toolkit.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
