Webhooks

Test locally

Receive staging webhook deliveries locally through an HTTPS tunnel.

Run your receiver locally and expose its webhook route through an HTTPS tunnel. Use a staging merchant. Mock API responses do not emit events.

The verified public CLI v0.1.2 does not provide the newer listen / trigger workflow. This tunnel approach works independently of those unreleased commands. See CLI availability.

Test your receiver

Start the application

Run your application on port 3000 with a POST route at /webhooks/revkeen. Implement signature verification and durable acceptance.

Open an HTTPS tunnel

Use your organisation's approved tunnel provider to forward to http://localhost:3000. Keep it running. Append /webhooks/revkeen to its public HTTPS address. The address may change when the tunnel restarts.

Register the staging endpoint

Follow endpoint setup using the tunnel URL. Store its signing secret locally as REVKEEN_WEBHOOK_SECRET, outside source control. Restart the application if it reads environment variables only at startup.

Verify delivery

Use the dashboard test action. Inspect the HTTP status and check that your receiver accepted the event durably before returning 2xx. Log IDs, timing, and status; keep secrets and customer payloads out of shared logs.

Exercise recovery

In your own test harness, simulate unavailable inbox storage and return 503. Restore storage and confirm a retry is accepted once. Send a duplicate signed fixture to verify that it does not repeat the business operation. Keep signature verification enabled.

Secrets and environments

TestSecretMeaning
Staging endpoint through a tunnelThat endpoint's signing secretReal staging delivery
Your own signed fixtureIsolated test-only secretReceiver test, not proof of RevKeen emission
Demo API playgroundNoneExample response; no webhook delivery

Provider configuration determines staging side effects. Do not assume every provider connection is in test mode. A receiver test should not require a live transaction.

Finish testing

Disable or remove the temporary endpoint and stop the tunnel. Use a stable HTTPS URL and a separate production signing secret when deploying.

Continue with delivery and retries.

On this page