⚡ HookStudio

The open-source, self-hosted webhook testing & replay studio.
Inspect, verify HMAC signatures, simulate upstream failures, and relay webhooks to localhost in real time.

Quickstart • Why HookStudio? • Features • HMAC Verification • Docker Deployment • Contributing

┌──────────────────────────────────────────────────────────┐
│  Inbound Webhooks (Stripe / GitHub / Shopify / Slack)    │
└────────────────────────────┬─────────────────────────────┘
                             │ POST /api/hooks/:id
                             ▼
┌──────────────────────────────────────────────────────────┐
│                   ⚡ HookStudio Engine                    │
│      (Inspect • Verify HMAC • Store in SQLite)           │
└──────────────┬───────────────────────────┬───────────────┘
               │ Auto-Relay                │ WebSocket Stream
               ▼                           ▼
┌──────────────────────────────┐ ┌─────────────────────────┐
│ Target App (localhost:3000)  │ │ Modern Web UI Dashboard │
└──────────────────────────────┘ └─────────────────────────┘

---

🎯 The Problem HookStudio Solves

Testing webhooks locally is notoriously frustrating:

• Cloud SaaS Limits: Services like Webhook.site or Hookdeck restrict history, require paid tiers, and show ads.
• Privacy & Security: Sending sensitive production or test payloads (customer PII, API tokens) through third-party servers creates privacy risks.
• Replay Friction: Re-triggering a payment in Stripe or a git push in GitHub just to test a 2-line code fix wastes hours.
• HMAC Headaches: Validating complex cryptographic signatures (Stripe-Signature, X-Hub-Signature-256) is error-prone.

HookStudio gives you a private, lightning-fast, zero-account webhook studio that runs directly on your machine or VPS.

---

🚀 Quickstart

Run HookStudio immediately without installing anything:

npx hookstudio

Then open http://localhost:4000 in your browser!

Running in Development

# Clone repository
git clone https://github.com/Samijain03/HookStudio.git
cd HookStudio

# Install dependencies
npm install

# Run backend and frontend concurrently
npm run dev

Send an Instant Test Webhook

Want to see it in action without configuring Stripe or GitHub first?

# In another terminal:
npm run send-sample

# Or send a raw cURL:
curl -X POST "http://localhost:4000/api/hooks/default" \
  -H "Content-Type: application/json" \
  -d '{"event": "payment.succeeded", "amount": 4900, "customer": "cus_123"}'

---

⚖️ Why HookStudio?

Feature	HookStudio	Webhook.site	Hookdeck	ngrok
100% Open-Source (MIT)	✅ Yes	❌ Proprietary	❌ Proprietary	❌ Proprietary
Self-Hosted & Private	✅ Yes	⚠️ Partial	❌ Cloud-only	❌ Cloud-only
No Account / No Sign-up	✅ Yes	⚠️ Rate-limited	❌ Required	❌ Required
Real-Time WebSocket Stream	✅ Sub-ms	⚠️ Polling / Slow	✅ Yes	❌ CLI-only
HMAC Signature Verifier	✅ Built-in	❌ Manual	⚠️ Limited	❌ No
1-Click Replay & Edit	✅ Yes	⚠️ Paid tier	✅ Yes	⚠️ Replay only
Mock Responses & Delays	✅ Yes	⚠️ Paid tier	⚠️ Limited	❌ No
Code & Session Exporter	✅ Yes	❌ No	❌ No	❌ No
Persistent SQLite Storage	✅ Zero-config	❌ Discarded	⚠️ Cloud store	❌ Ephemeral

---

✨ Key Features

1. Real-Time Webhook Feed

Incoming HTTP requests appear instantly via WebSockets with zero page refreshes. Inspect status codes, HTTP methods, headers, query parameters, and payloads.

2. Built-in HMAC Signature Verifier

Validate webhook signatures in seconds. HookStudio provides dedicated cryptographic verification engines for:

• Stripe (Stripe-Signature with timestamp validation)
• GitHub (X-Hub-Signature-256 HMAC-SHA256)
• Shopify (X-Shopify-Hmac-Sha256 Base64)
• Twilio (X-Twilio-Signature Base64)
• Paddle (Paddle-Signature HMAC-SHA256)
• Slack (X-Slack-Signature v0:...)
• Svix (svix-signature)
• Custom HMAC-SHA256 / HMAC-SHA1

3. One-Click Replay & Edit-and-Resend

Did your backend handler crash on a webhook? Fix the bug, click Replay, and resend the exact payload to your local endpoint (http://localhost:3000/api/webhook). You can even tweak the JSON body or headers inside the interactive editor before resending!

4. Automatic Webhook Relaying

Set an Auto-Relay URL on any endpoint. When a webhook arrives, HookStudio automatically forwards it to your local server and logs the round-trip latency, response status, and response body.

5. Mock Response Rules & Chaos Testing

Test how webhook providers handle upstream issues:

• Return custom status codes (500 Server Error, 429 Rate Limited, 400 Bad Request).
• Inject simulated network delays (e.g. 2,000ms delay to test timeout handling).
• Return custom JSON error payloads.

6. Code & Session Export

• Instantly export captured webhooks into copy-paste code snippets (cURL, JavaScript Fetch, Python requests, Go net/http).
• Export captured webhook events as standalone .json files or bulk export sessions via API.

---

🔐 HMAC Signature Verification

HookStudio verifies raw payloads against your provider secret using constant-time comparison to prevent timing attacks:

import { verifySignature } from 'hookstudio/crypto';

const result = verifySignature({
  provider: 'stripe',
  secret: 'whsec_...',
  rawBody: req.rawBody,
  signatureHeader: req.headers['stripe-signature'],
});

console.log(result.valid); // true

---

🐳 Docker Deployment

HookStudio can be deployed anywhere in 10 seconds using Docker:

docker compose up -d

Your webhooks and endpoint configurations are automatically persisted across container updates via a named SQLite volume.

---

🛠️ Tech Stack

• Server: Node.js, Express, TypeScript, ws (WebSockets), Node crypto, node:sqlite.
• Frontend: React 19, Vite, Tailwind CSS v4, Lucide Icons.
• Data Layer: Embedded SQLite with WAL mode for ultra-fast zero-configuration writes.

---

🤝 Contributing

Contributions are welcome! If you'd like to add support for a new webhook provider, improve the UI, or add an export format:

1. Fork the repository
2. Create your feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

---

📄 License

Distributed under the MIT License. See LICENSE for more information.

If you find HookStudio helpful, please give it a ⭐️ on GitHub!