Send. Catch. Understand.
Everything you need to go from your first request to a replayed webhook.
Quick start
Sign in with Google or GitHub. A private workspace is created for you automatically. Open Webhook Inbox and choose New unique URL: you get a private delivery URL on hooks.hookripple.com straight away. Paste it into any service that sends webhooks. Any sub-path and query string after the URL is captured too.
The connected workflow
Select your endpoint in the API Client, put {{webhook_url}} in the callback field of a request, and send it. The response appears in the request pane while the resulting webhook streams into the inbox, linked by an explicit correlation ID. Try callback loop runs the same flow against a built-in synthetic integration so you can see it end to end without an external service.
Execution modes
The cloud relay processes your request, including target credentials, on HookRipple servers. It accepts public HTTP and HTTPS destinations on ports 80 and 443, does not follow redirects, and blocks private networks. Browser-direct requests are sent by your own browser, obey CORS and browser header restrictions, omit cookies and are not stored in server history. Localhost and private targets need a future local agent.
Variables and secrets
Three layers resolve in order: project variables (shared by the whole workspace), the selected environment, then request variables. The most specific wins, and the eye icon next to the environment picker shows what each name resolves to. Dynamic values work everywhere: {{$guid}}, {{$timestamp}}, {{$timestampMs}}, {{$isoTimestamp}}, {{$randomInt}} and {{$randomHex}}. The reserved {{webhook_url}} always comes from the selected endpoint. Missing values or cycles stop execution before anything is sent. Secrets are encrypted at rest and omitted from exports.
Authorization
Choose Inherit, None, Basic, Digest, Bearer, OAuth 2.0, API key, AWS Signature v4, Hawk or JWT. Inherit uses the authorization set on the request’s collection or its parents. Digest challenges are answered automatically. OAuth 2.0 supports the authorization-code flow with PKCE (click “Get new access token”, sign in with the provider in a pop-up, and register https://hookripple.com/oauth2/callback as the redirect URI), client credentials and password grants (a fresh token is fetched from an HTTPS token URL through the relay each time you send), or a token you paste. AWS Signature, Hawk and JWT are computed at send time over the final URL, headers and body. Every field accepts variables.
Checks and the collection runner
Add declarative checks to a request: status code, header, body text, JSON path or response time, compared with equals, contains, exists, less or greater than, or a regular expression. Results appear with every response. Run a whole collection from the Collections page to send each saved request in order and see which requests and checks passed. Checks never execute code.
Code generation
Code turns the current request into cURL, JavaScript, Python, Go, PHP or C#. Variables stay as {{placeholders}}, so environment secrets are never copied into snippets.
Callbacks and replay
Raw body bytes are captured at the ingress boundary and encrypted separately from parsed views. Proxies may normalise header names, combine repeated headers and decode transport framing. Every retry from a provider is kept; a matching body is labelled a likely duplicate, never discarded. Replay is always explicit: edit, review, confirm. It may cause real side effects, and original provider signatures may not validate.
Limits during beta
1 MiB inbound and request bodies, 5 MiB responses, 30 seconds per outbound request, 24-hour payload retention (adjustable in Settings), 10 endpoints, 100 MiB captured body storage, 60 requests per minute per operation category and 3 concurrent relay runs per workspace.
What is coming
Shared workspaces and invitations, longer retention, automation tokens, a local agent for private targets, broader import formats and scheduled requests are on the roadmap. Beta users hear about new features first.