Inspiration
The inspiration for this project came from the daily frustrations of testing third-party integrations. Traditional tools like webhook.site are great for quick captures but lack the security, persistence, and persistence required for professional development. Tunnelling tools like ngrok are powerful but require local setup and aren't always ideal for team-wide debugging or long-term monitoring. We set out to build a "Swiss Army Knife" for webhook developers—a centralized, enterprise-hardened suite that lives in the cloud and provides total control over the request/response lifecycle.
What it does
The Webhook Debugger, Logger & API Mocking Suite is a unified environment for capturing, inspecting, and simulating webhook traffic.
- Real-time Debugging: Stream incoming requests instantly via Server-Sent Events (SSE).
- Advanced Mocking: Simulate any API response with custom status codes, bodies, headers, and artificial latency (up to 10s).
- Deep Inspection: View full payload histories, including auto-parsed JSON, XML, and form-data.
- Enterprise Security: Harden your endpoints with Bearer/Key Authentication, CIDR IP Whitelisting, and LRU-based Rate Limiting.
- Workflow Automation: resend captured events via the Replay API or automatically pipe traffic to other destinations with smart header stripping for privacy.
How we built it
The core engine is built on Node.js and Express, utilizing a sophisticated middleware pipeline to handle security, data masking, and rate limiting. We used the Apify SDK to leverage "Standby Mode," ensuring sub-10ms response times for incoming webhooks. For reliability, we implemented a rigorous testing architecture with 79 automated tests (Jest & Supertest) covering every edge case from memory leaks to high-concurrency race conditions.
Challenges we ran into
Balancing ultra-low latency with high security was our biggest hurdle. Implementing strict security measures like CIDR whitelisting and LRU (Least Recently Used) eviction for rate-limiting required careful optimization of the internal state management to avoid performance bottlenecks. We also had to solve the "credential leak" problem, ensuring that sensitive data is masked in logs and that management links never propagate API keys.
Accomplishments that we're proud of
- Achieving 100% clean test passes on a suite of 79 complex integration tests.
- Implementing a deterministic LRU eviction strategy that protects the Actor's memory under heavy load while prioritizing active developer sessions.
- Creating a Universal Auth UI that provides a premium, "locked-down" experience for browser users without a valid key.
- Successfully neutralizing the "XSS vs. Usability" trade-off by implementing robust HTML-escaping across all variable error outputs.
What we learned
Building this tool taught us the importance of "defense in depth." We learned that even a simple debugging tool needs to be built with an enterprise mindset—handling PII masking, anti-spoofing (Proxy trust controls), and timing-safe authentication. We also deepened our knowledge of high-performance state persistence in serverless environments.
What’s next for Webhook Debugger, Logger & API Mocking Suite
Our roadmap includes:
- AI-Powered Schema Detection: Automatically generating JSON Schemas from captured traffic patterns.
- Visual Workflow Builder: A drag-and-drop interface for piping webhooks between services.
- Advanced Filtering Engine: Support for complex SQL-like queries over captured historical data.
- Team Collaborative Workspaces: Allowing entire engineering teams to share and debug webhook streams in a unified dashboard.
Built With
- ajv
- apify-sdk
- express.js
- jest
- nanoid
- node.js
- supertest
