Inspect, replay, and re-sign
every webhook your stack receives.
Splithook captures from any provider, re-signs with your real secret and fans out to
localhost, staging, or multiple sites simultaneously.
One URL. Zero signature bypass hacks.
The webhook journey
From your provider to your localhost,
signature intact.
Architecture
Internet → re-sign → through NAT.
Events from any source hit Splithook, get re-signed, and cross the NAT barrier
to your local services — no manual signature bypass, no NODE_ENV hacks.
Auto-detection on capture · Re-signing on replay
Use cases
One tool, every webhook scenario.
Multi-site relay
One Stripe account.
Three independent sites.
Configure Splithook as your single Stripe webhook URL. It re-signs the event and fans it out to your DB and every site's API — simultaneously.
Local dev tunnel
External event. Localhost.
Signature valid.
AWS Lambda or Stripe fires to your Splithook URL.
Splithook re-signs and forwards through NAT to your local services —
no manual signature bypass, no NODE_ENV hacks.
Features
Every tool your webhook workflow needs.
01 / Auto re-signing
Signatures that actually
pass in dev.
Signing secrets encrypted at rest with libsodium. On every replay the HMAC is re-computed against the stored body bytes — identical code path to production.
Stripe-Signature: t=1714000001,v1=a3f9…8c2d
{
"id": "evt_1Pq…",
"type": "payment_intent.succeeded"
}
02 / Fan-out & filters
One event,
every destination.
Add destinations with optional per-destination filters (event type, expression language). Works for localhost ports, external APIs, and cross-site relays.
03 / Replay
Replay to localhost
One click. Timestamp swapped so 5-minute windows still pass. Original body bytes preserved.
# destination http://localhost:3000/webhooks ✓ 200 OK · 12ms
04 / Inspect
Split-screen inspector
Payload, headers, response side-by-side. Visual diff across replay iterations.
05 / Capture
Persistent capture
URL that never changes. Sub-50ms ingestion. Body and headers stored intact for 24h–90d.
if (env === 'development') { // signature won't match replay return handler(req.body); } verifyStripeSignature(req); handler(req.body);
Bugs surface in production only.
// re-signed at replay time // timestamp swapped to now() verifyStripeSignature(req); // ✓ handler(req.body);
Same code path, dev and prod.
Dev / prod parity
Stop disabling signature verification in dev.
Every webhook replay carries a fresh HMAC — timestamp rewritten, signature
recomputed with your real secret. Your verification middleware runs the exact
same code path in dev as in production.
No NODE_ENV branches.
No if dev: skip.
Bugs that only appear in production become bugs you catch in dev.
- Stripe tolerance window: timestamp rewritten so 5-min window passes
- GitHub: sha256-hex recomputed over preserved body bytes
- Shopify: base64 HMAC — not hex, not URL-encoded, exactly per spec
- Twilio: SHA-1 of URL + sorted form fields, destination URL-aware
Honest comparison
Splithook vs the alternatives.
Each tool exists for a reason — most are great at one job. Splithook is the only one that re-signs replays with your real provider secret, which is the difference between a debugging session that mirrors production and one that doesn't.
| Capability | Splithook | ngrok | smee.io | webhook.site | Hookdeck |
|---|---|---|---|---|---|
| Public capture URL | — | ||||
| Replay to localhost | — | — | |||
| HMAC re-signing | — | — | — | — | |
| Multi-destination fan-out | — | — | — | ||
| Tunnel to localhost | — | — | — | ||
| Provider-aware inspection | — | — | — | ||
| Built-in retention & replay history | — | — |
Why re-signing matters: any tool that captures and replays without re-signing hands your handler a body whose signature was computed against the original timestamp. Once that timestamp is older than the provider's tolerance window (5 min for Stripe), your middleware rejects it as a replay attack. Splithook regenerates the timestamp and HMAC every time.
Combine, don't replace: Splithook + ngrok is a common setup. Use Splithook as the public capture URL and ngrok as the tunnel to localhost. Stable URL on the provider side, fresh tunnel every dev session, zero signature pain.
Pricing
Start free. Upgrade when
you replay signed webhooks.
Cancel anytime. No credit card on Free.
Solo dev. Covers the basics forever.
- 1 endpoint
- 24h retention
- 500 req/mo
- Manual replay
- No credit card
More capacity, same focus.
- 3 endpoints
- 7d retention
- 10k req/mo
- Re-signing (1 provider)
- Email support
Full re-signing. Multi-site fan-out.
- 10 endpoints
- 30d retention
- 100k req/mo
- Re-signing (all providers)
- Fan-out · Filters · Multi-site
- Priority support
Multi-user with shared signing secrets.
- Unlimited endpoints
- 90d retention
- 500k req/mo
- 5 users
- Shared secrets
- SSO ready
All plans include fan-out, inspection, and live streaming. · See full feature comparison
FAQ
Common questions, answered.
How is webhook re-signing safe? +
Does my handler verify signatures normally? +
Which providers are supported for re-signing? +
How is Splithook different from ngrok? +
Does Splithook store webhook bodies? +
What HMAC algorithms does Splithook support? +
What happens when my localhost is offline? +
Can I use Splithook in CI/CD pipelines? +
How fast is the capture-to-localhost path? +
Stop debugging webhooks in production.
Sign up in 30 seconds, paste your endpoint URL into Stripe, and watch the next webhook hit your dashboard in real-time.
$ curl https://e.splithook.com/your-endpoint -X POST -d ''