Skip to main content

Testing and troubleshooting

Signature tester​

Paste a request body and the API key of your webhook to compute its signature. Add the ob-signature you received to check it: if it does not match, the tester tries the most common mistakes (a re-serialized body, extra whitespace, a key with spaces) and tells you which one explains the difference.

Use Load example to see a valid request, and Replay this delivery to generate a curl command that sends the same signed request to your own endpoint.

Runs entirely in your browser: the body and API key are never sent anywhere.
Enter a body and an API key to compute the signature.
Replay this delivery to your endpoint

Generates a curl command that sends this body to your endpoint with the same headers the platform sends, signed with the key above. The body is written to a file first so that curl sends it byte for byte: -d would strip its line breaks and break the signature.

Enter a body and an API key above to generate the command.

Test with your own key

Everything runs in your browser and nothing is sent anywhere, but treat production API keys with care anyway: for tests, prefer a webhook configured in the test environment.

Receive webhooks on your machine​

Onebox can only deliver to a URL reachable from the internet. To receive real deliveries on a local server, expose it through a tunnel and configure the tunnel URL in the webhook:

  • ngrok: ngrok http 3000 gives you a public HTTPS URL that forwards to localhost:3000, and an inspector to see and replay every request.
  • Cloudflare Tunnel: cloudflared tunnel --url http://localhost:3000 does the same without an account.
  • Webhook.site gives you a URL that only records requests, to look at real headers and bodies before you write any code. Do not use it with production data.

To trigger real deliveries, make a test purchase, refund, transfer or catalog change in the test environment on a channel or entity covered by the webhook. The quickstart walks through the whole setup.

Troubleshooting​

I do not receive any request​

  • Check that the webhook is active and that it subscribes to the event and the action you are testing: a webhook that subscribes to ORDER_PURCHASE does not receive ORDER_REFUND.
  • Check the scope and the entity: order notifications go to the entity that owns the sales channel, and catalog notifications to the entity that owns the event. A CHANNEL webhook only receives order notifications of its channel. Each page of the event reference says which entity receives it.
  • Seat relocations (RELOCATE) are only delivered to webhooks subscribed to ORDER_PURCHASE, and the companion UPDATE only to webhooks that also subscribe to ORDER_UPDATE.
  • Make sure the URL is reachable from the internet, has a valid certificate and is not blocked by a firewall.
  • Make sure the URL does not redirect, for example because of a missing trailing slash or www: redirects are not supported.

The signature never matches​

Paste one request into the signature tester. The usual cause is a framework that parses the JSON body before your code runs, so you hash a re-serialized body instead of the raw bytes. See Verify signatures.

I receive the same notification twice​

That is expected: deliveries can be retried and some changes produce more than one notification. Make your processing idempotent as explained in Delivery and retries.

I missed a notification​

Delivery is not guaranteed: after the last retry fails, the notification is not sent again. Reconcile periodically through the API, as described in Delivery and retries.