Point a webhook here and read every byte it sent.
Weky hands you an HTTPS endpoint that writes down the method, the headers and the exact body of everything that reaches it. It answers with whatever you tell it to, and when the sender signs its requests, it recomputes the signature and tells you whether it holds.
https://weky.zanoski.com/w/············
curl -X POST https://weky.zanoski.com/w/············ \
-H 'content-type: application/json' \
-d '{"event":"ping"}'ArrivedPOST
- content-type
- application/json
- user-agent
- Stripe/1.0
- stripe-signature
- t=1757620931,v1=5f2c…
{
"type": "invoice.paid",
"amount": 4900
}signature verified
Sent back200
- content-type
- application/json
- x-weky-request-id
- 41207
{
"ok": true
}Yours to change: any status, any body, any header, and a delay if you want to see how the sender copes with a slow reply.
Signatures it can actually check
Reading a header and seeing that it starts with the right word proves nothing. Every one of these recomputes the value the sender claimed, from the body Weky received, and compares the result.
Basic
Decodes the base64 pair and compares both halves in constant time.
Bearer token
Compares the token in constant time.
API key
Compares the header value in constant time.
JWT
Verifies the signature against the secret or the PEM key, then exp, nbf, issuer and audience.
HMAC signature
Recomputes HMAC SHA-256 over the exact bytes the sender signed, including the timestamp where the service folds one in.
Digest
Issues its own nonce, then recomputes HA1, HA2 and the response for MD5, SHA-256, the sess variants and auth-int.
Hawk
Rebuilds the normalised string, recomputes the MAC, and checks the payload hash against the body when one is sent.
AWS Signature V4
Rebuilds the canonical request and the string to sign, derives the four round signing key, and compares the signature.
Akamai EdgeGrid
Derives the signing key from the timestamp, rebuilds the data to sign including the truncated Authorization header, and compares.
NTLM
Answers the negotiate with its own challenge, then recomputes the NTv2 proof from the password, the challenge and the client blob.
Atlassian ASAP
Verifies the RSA signature against the PEM key, then requires kid, iss, aud, sub, exp, iat, jti and a lifetime under an hour.
Nothing to sign up for
There are no accounts. The random part of the URL is the only key, so treat it the way you would treat a password and do not paste it into a public issue.
It forgets on purpose
An endpoint keeps its last 200 requests and disappears 24 hours after the last one arrives. Sending to it again pushes that clock back.
Every method, any body
GET through DELETE, JSON, forms, XML, plain text or binary, with CORS wide open so a browser can reach it too. Anything after the id in the path is kept, so you can see which route was called.