Create a webhook endpoint
- Open your project and click New Endpoint.
- Set the Method to
POST(most webhook providers use POST). - Set the Action:
- Async API — acknowledges the provider immediately (
202) and delivers to your handler in the background, with automatic retries. This is the recommended mode for webhooks: providers expect a fast response and will retry their side if you’re slow, so let getrequest absorb that instead of your handler. See Sync vs. Async endpoints. - Sync API — proxies inline and waits for your handler’s response, if you need the provider to see your handler’s actual reply.
- Static API — capture without forwarding anything yet (see below).
- Async API — acknowledges the provider immediately (
- Give it a descriptive Name like
Stripe webhookorGitHub webhook— this is just a label for your own reference; it doesn’t appear in the URL.
Register it with your provider
- Stripe
- GitHub
- Any provider
- Go to Stripe Dashboard → Webhooks.
- Click Add endpoint.
- Paste your getrequest URL.
- Select the events to listen for (e.g.
payment_intent.succeeded). - Click Add endpoint.
Inspect a captured webhook
Open Logs in your project. Every webhook event appears as a row. Click any row to inspect:- Headers — signature headers (
Stripe-Signature,X-Hub-Signature-256), content type, and any custom metadata the provider sends - Body — the full JSON payload
- Response — what your backend returned (status code and body)
- Duration — round-trip time from getrequest to your backend
Replay a webhook (paid plans — see FAQ)
Found a failed event? Replay it with one click without waiting for the provider to resend.- Open the log entry.
- Click Replay.
- getrequest re-fires the exact same request — same headers, same body — to your backend.
- The new response appears immediately.
Replay requires a Sync API or Async API endpoint. Static API endpoints have no destination to replay to.
Verify webhook signatures
This is the one place forwarding behavior actually matters: getrequest does not forward every header to your backend unchanged. Only a fixed allow-list, plus anything starting withX-, makes it through — see Limits, timeouts & error responses for the full list. That has a real consequence for signature headers:
X-Hub-Signature-256(GitHub) — starts withX-, forwarded fine. Your own verification code works exactly as it would with a direct connection.Stripe-Signature(Stripe) — does not start withX-and isn’t on the allow-list, so it is stripped before reaching your backend. Your own handler-side verification againstStripe-Signaturewill never see the header if you’re forwarding through getrequest.
X-), don’t rely on your backend to verify it — have getrequest verify it instead, before the header ever gets dropped: set the endpoint’s Authentication to HMAC, point it at the provider’s signature header name, and supply the provider’s signing secret. Requests with an invalid or missing signature get rejected with 401 before reaching your backend at all — see Authenticate endpoints and destinations for the exact fields.