Docs.

01 — Quickstart

Three steps, no account

1. Click Generate free webhook URL on the homepage. You are redirected to your private inspector at /app/{slug}.
2. Copy the target URL from the top bar. It looks like https://snaphook.site/w/{slug}.
3. Point any HTTP client or webhook provider at it. Captures appear in the inspector the instant they land — no refresh.

Nothing else is required. There is no account to create, no key to configure, and no SDK to install.

02 — URL anatomy

Two URLs per session

The slug is 12 characters drawn from a 32-symbol alphabet by a cryptographic random source — roughly 60 bits of entropy. It is the only thing protecting your session, which is why it is never logged, never indexed, and never shown to anyone you do not share it with.

04 — The inspector

Reading a capture

The dashboard is a two-pane master-detail view. The left pane lists captures newest first with the method, path, relative time and payload size. The right pane breaks the selected capture into four parts:

• Metadata — method, full path with query string, protocol, client IP, timestamp and captured size.
• Headers — every header exactly as received, including duplicates.
• Query parameters — the parsed query string, with repeated keys preserved as lists.
• Body — pretty-printed when the payload is valid JSON, raw otherwise, with a toggle between the two.

The status pill in the top bar reports the live connection: live when the stream is attached, retrying while reconnecting, and expired once the session is gone. Clear discards the history but keeps the URL working.

05 — API reference

HTTP API

Every endpoint returns JSON and needs no authentication beyond knowing the slug.

Capture shape

{
  "id": 3,
  "timestamp": "2026-01-14T09:31:07.482Z",
  "method": "POST",
  "path": "/orders/created?source=stripe",
  "proto": "HTTP/1.1",
  "remote_ip": "203.0.113.7",
  "headers": { "Content-Type": ["application/json"] },
  "query_params": { "source": ["stripe"] },
  "body": "{\"order_id\":4021}",
  "size": 18,
  "truncated": false
}

06 — Live stream

Server-Sent Events

Connecting to /api/{slug}/sse yields three event types:

• init — sent immediately, carrying the whole retained history. Because the snapshot ships with the connection, there is no window in which a capture can be missed between fetching history and subscribing, and every reconnect re-syncs from scratch.
• request — one capture, in the shape above.
• expired — the session was purged; the stream then closes.

A : ping comment is sent every 25 seconds to keep intermediate proxies from dropping an idle connection.

const stream = new EventSource(`/api/${slug}/sse`);

stream.addEventListener("init", (e) => {
  const { requests } = JSON.parse(e.data);
  console.log(`replaying ${requests.length} captures`);
});

stream.addEventListener("request", (e) => {
  const capture = JSON.parse(e.data);
  console.log(capture.method, capture.path, capture.size);
});

From the command line, curl -N https://snaphook.site/api/YOUR_SESSION_ID/sse prints the raw frames.

07 — Limits

What the service will and will not hold

These are memory-safety bounds, not upsell gates — SnapHook runs on a small VM and holds everything in RAM, so the ceilings are what keep it responsive for everyone.

08 — Provider setup

Wiring up a real sender

The pattern is identical everywhere: paste https://snaphook.site/w/{slug} where the provider asks for a destination URL, then trigger a test event.

• Stripe — Developers → Webhooks → Add endpoint, then Send test webhook. Append a sub-path such as /stripe to keep senders distinguishable.
• GitHub — Repository or organisation Settings → Webhooks → Add webhook. Set content type to application/json; the Recent Deliveries tab and SnapHook should agree exactly.
• Shopify, Twilio, Slack, Zapier, n8n — any field labelled callback, webhook or destination URL accepts a SnapHook endpoint as-is.
• Your own code — point a cron job, CI step or retry queue at it to confirm what it actually sends, headers included.

SnapHook always answers 200 quickly, so a provider's delivery log should show success. If it does not, the failure is between the provider and this service — check the sub-path and that the session has not expired.

09 — Security

Treat the session URL as a secret

SnapHook has no accounts, so the slug is the credential. Anyone who obtains it can read every capture in that session until it expires. That leads to a short list of rules:

• Use test-mode credentials only. Never send live API keys, bearer tokens, session cookies or signing secrets.
• Never send personal data. Real customer records do not belong in a public inspection endpoint, regardless of retention policy.
• Do not paste session URLs into public issues, gists or screenshots. Anything indexed is anything readable.
• Clear the history when you are done, or simply walk away — the session is purged after 2 hours of inactivity either way.

What the service does on its side

• Session surfaces send X-Robots-Tag: noindex, nofollow, noarchive and are disallowed in robots.txt.
• Captures live in process memory only. There is no database and no payload logging.
• X-Content-Type-Options, X-Frame-Options: DENY, a strict Content-Security-Policy and Referrer-Policy: strict-origin-when-cross-origin are set on every response.
• Per-IP token buckets cap session creation and ingestion so one sender cannot starve the rest.

See the privacy policy for the retention guarantee and the terms of use for what the endpoint may not be used for.

10 — Self-hosting

Run your own

SnapHook is a single static Go binary with no dependencies, no database and no configuration file. If you would rather not send even test payloads to someone else's host, run it yourself:

CGO_ENABLED=0 go build -o snaphook ./cmd/server
GOMEMLIMIT=1600MiB ./snaphook -addr 127.0.0.1:8080 -base-url https://hooks.example.com -trust-proxy

Put any TLS-terminating reverse proxy in front of it. Enable -trust-proxy only when that proxy overwrites X-Forwarded-For; otherwise clients can forge an address and evade the rate limiter.