How to test a webhook locally

# Once: log in to your Stripe account
stripe login

# Forward events to your handler. It prints a signing secret:
# "Your webhook signing secret is whsec_…" — use that one locally
stripe listen --forward-to localhost:3000/webhook

# In a second terminal: send a test event
stripe trigger payment_intent.succeeded

# Once: install the extension
gh extension install cli/gh-webhook

# Forward a repository's issue events to your handler.
# --secret makes GitHub sign deliveries, so you can test verification.
gh webhook forward --repo=OWNER/REPO --events=issues \
  --url=http://localhost:3000/webhook --secret=dev-secret

# Once: sign up at ngrok.com and add your authtoken
ngrok config add-authtoken <your-token>

# Expose port 3000; register https://<your-dev-domain>/webhook with the provider
ngrok http 3000

# No account needed. Prints https://<random-words>.trycloudflare.com
cloudflared tunnel --url http://localhost:3000

# Register https://<random-words>.trycloudflare.com/webhook with the provider.
# The URL changes every time you restart cloudflared.

# 1. Open whatiswebhook.com/webhook-tester.html and copy your URL
# 2. Register it with the provider and trigger an event
# 3. In the tester, open "Replay locally" and run the command it shows:
printf '%s' '{"id":"evt_1","type":"payment_intent.succeeded"}' | \
curl -X POST 'http://localhost:3000/webhook' \
  -H 'Content-Type: application/json' \
  -H 'Stripe-Signature: t=…,v1=…' \
  --data-binary @-

import express from "express";
import Stripe from "stripe";

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
const app = express();

// The raw body on this route only: the signature covers the exact bytes.
app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
  let event;
  try {
    event = stripe.webhooks.constructEvent(
      req.body, req.headers["stripe-signature"], process.env.STRIPE_WEBHOOK_SECRET);
  } catch (err) {
    return res.status(400).send(`Bad signature: ${err.message}`);
  }
  res.sendStatus(200);      // answer first…
  handle(event);            // …then work, and skip event.id values you've seen
});

app.use(express.json());    // JSON parsing for every other route, after the webhook
app.listen(3000);

import os
import stripe
from flask import Flask, request

app = Flask(__name__)

@app.post("/webhook")
def webhook():
    # get_data() is the raw body; request.json would be too late
    payload = request.get_data()
    try:
        event = stripe.Webhook.construct_event(
            payload, request.headers.get("Stripe-Signature"),
            os.environ["STRIPE_WEBHOOK_SECRET"])
    except (ValueError, stripe.error.SignatureVerificationError):
        return "Bad signature", 400
    queue_for_later(event)  # keep the response fast
    return "", 200

app.run(port=3000)