​

Test webhooks with the Webhook Tester

• The tester delivers through Orbit’s dispatcher, so the HTTP POST reaching your server is real — your URL must be publicly reachable over HTTPS.
• Test sends are unsigned. Registered endpoints get full X-Orbit-Signature HMAC headers; the tester has no endpoint secret, so it cannot sign. If your receiver rejects unsigned requests, the tester will return a 401/403 — see the signature checklist below.

​

Open the tester

​

Pick an event type

​

Send a test and read the result

1. Paste your endpoint URL into the URL field. It must be HTTPS and publicly reachable — URLs that resolve to private or internal addresses are rejected.
2. Pick the event type and edit the payload if needed.
3. Click Send.

• Status — the HTTP status code your endpoint returned (200, 401, 404, …). A transport failure (unreachable host, timeout, TLS error) shows as an error instead of a status.
• Response time — round-trip milliseconds.
• Response headers — every header your server returned.
• Response body — the raw body, pretty-printed when it’s JSON.

• 2xx — your endpoint accepted the event. Green light.
• 404 — your server answered but no route matched the path. The URL path is wrong — check exactly which path your receiver listens on. A 404 is never a signature problem.
• 401 / 403 — your endpoint rejected the request. The common cause: your receiver verifies the signature and the tester’s send is unsigned. Work through the checklist below.
• Other non-2xx — your handler rejected or errored on the payload. The response body in the history panel usually says why.

​

Signature-verification checklist

1. Expect the tester to fail signature checks. No endpoint secret exists for an ad-hoc URL, so no X-Orbit-Signature header is attached. A verification-first receiver correctly returns 401/403.
2. To test the signature path itself, use the signed Test action on a registered endpoint. Register the URL under Settings → Webhooks, copy the cleartext whsec_... secret shown once at registration, then use that endpoint’s Test action — registered deliveries are signed with your secret and exercise your full verification logic.
3. Verify against the raw body. The HMAC is computed over the exact bytes received. A JSON middleware that parses the body before verification changes the bytes and fails the check.
4. Check the timestamp window. Reject signatures older than 5 minutes — but verify your server’s clock is sane first; a skewed clock rejects every delivery.
5. Compare timing-safe. Use your language’s constant-time comparison (crypto.timingSafeEqual, hmac.compare_digest) so a signature mismatch is never distinguishable by response time.

​

Worked example — send message.delivered and parse the response

1. Open Developer → Webhook Tester.
2. Enter your URL: https://yourapp.com/webhooks/orbit.
3. Select message.delivered. The editor pre-fills:

{
  "id": "evt_d4e5f6g7h8",
  "type": "message.delivered",
  "created_at": "2026-03-08T14:30:05Z",
  "data": {
    "message_id": "msg_abc123",
    "channel": "sms",
    "to": "+14155552671",
    "status": "delivered",
    "delivered_at": "2026-03-08T14:30:05Z"
  }
}

4. Click Send.
5. Your endpoint acked, so the history shows a new entry with status 200 and a response time — for example 187 ms.
6. Expand the entry. The response panel shows your server’s actual reply:

{
  "received": true
}

​

Live event stream

​

See also

• Build your first webhook receiver — verified receiver, dedup, and retry handling end to end
• Webhooks overview — delivery guarantees and endpoint management
• Webhook security — canonical HMAC reference and secret rotation
• Event payloads — envelope schema and request headers
• Troubleshooting signature failures — when verification fails in production