Deploy webhook listeners.
Take your webhook handler live at a stable HTTPS endpoint. Every request is saved for testing and debugging.
AI agent? Start with llms.txt.
What you can connect
Webhook listeners fit events sent by another system.
Payment events.
Receive Stripe or PayPal webhooks when a payment changes state.
Code and delivery events.
Handle GitHub push events and other callbacks from your development tools.
Messaging and service callbacks.
Connect Slack, Twilio, SendGrid, and other systems that send HTTP events.
From handler to live endpoint
Keep the handler focused on the event. We provide the endpoint and the evidence around every request.
Step 01
Use the handler shape you already have.
Bring an HTTP route or a function that handles one request. We detect the form and set up the webhook Service.
Step 02
Give the sender a stable URL.
Copy the deployed HTTPS endpoint into Stripe, GitHub, or the system sending events.
Step 03
Verify the code before relying on it.
Send Test Event checks the deployed handler before the real sender is configured.
Step 04
Replay the event after a fix.
Request history preserves the payload and response, while Copy as cURL reproduces the delivery.
Just write your handler
Use the framework and request handling code that already fit your integration.
Node.js webhook
const express = require('express');
const app = express();
const port = process.env.PORT || 3000;
const secret = process.env.WEBHOOK_SECRET;
app.use(express.json());
app.post('/webhook', (req, res) => {
if (!secret || req.get('x-webhook-secret') !== secret) {
return res.sendStatus(401);
}
console.log('event received', req.body.type);
res.sendStatus(204);
});
app.listen(port);
Python webhook
import os
from flask import Flask, request
app = Flask(__name__)
@app.post('/webhook')
def webhook():
secret = os.getenv('WEBHOOK_SECRET')
if not secret or request.headers.get('X-Webhook-Secret') != secret:
return 'Unauthorized', 401
event = (request.get_json(silent=True) or {}).get('type')
print('event received', event)
return '', 204
if __name__ == '__main__':
port = int(os.getenv('PORT', '5000'))
app.run(host='0.0.0.0', port=port)
Go webhook
package main
import (
"log"
"net/http"
"os"
)
func webhook(w http.ResponseWriter, r *http.Request) {
secret := os.Getenv("WEBHOOK_SECRET")
if secret == "" || r.Header.Get("X-Webhook-Secret") != secret {
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
}
log.Println("event received")
w.WriteHeader(http.StatusNoContent)
}
func main() {
port := os.Getenv("PORT")
if port == "" {
port = "8080"
}
http.HandleFunc("/webhook", webhook)
log.Fatal(http.ListenAndServe(":"+port, nil))
}
What Tokay handles
HTTPS and access controls.
We issue and renew the endpoint certificate. Outside providers can call a Public Service, while systems you control can use Restricted access with Machine credentials.
Request history and replay.
Each delivery records its source, method, status, duration, and payload so the same event can be tested again.
Encrypted webhook secrets.
Store the provider secret in Project Secrets rather than source. The handler still verifies the signature or shared secret before processing a payload.
Read the webhooks doc for request history, testing, and replay
All set for live traffic.
Write your endpoint. We give you a secure HTTPS URL. That's the deal.