Test locally
Receive staging webhook deliveries locally through an HTTPS tunnel.
Run your receiver locally and expose its webhook route through an HTTPS tunnel. Use a staging merchant. Mock API responses do not emit events.
The verified public CLI v0.1.2 does not provide the newer listen / trigger
workflow. This tunnel approach works independently of those unreleased commands.
See CLI availability.
Test your receiver
Start the application
Run your application on port 3000 with a POST route at /webhooks/revkeen.
Implement signature verification and durable acceptance.
Open an HTTPS tunnel
Use your organisation's approved tunnel provider to forward to http://localhost:3000.
Keep it running. Append /webhooks/revkeen to its public HTTPS address.
The address may change when the tunnel restarts.
Register the staging endpoint
Follow endpoint setup using the tunnel URL.
Store its signing secret locally as REVKEEN_WEBHOOK_SECRET, outside source control.
Restart the application if it reads environment variables only at startup.
Verify delivery
Use the dashboard test action. Inspect the HTTP status and check that your receiver
accepted the event durably before returning 2xx. Log IDs, timing, and status;
keep secrets and customer payloads out of shared logs.
Exercise recovery
In your own test harness, simulate unavailable inbox storage and return 503.
Restore storage and confirm a retry is accepted once. Send a duplicate signed fixture
to verify that it does not repeat the business operation. Keep signature verification enabled.
Secrets and environments
| Test | Secret | Meaning |
|---|---|---|
| Staging endpoint through a tunnel | That endpoint's signing secret | Real staging delivery |
| Your own signed fixture | Isolated test-only secret | Receiver test, not proof of RevKeen emission |
| Demo API playground | None | Example response; no webhook delivery |
Provider configuration determines staging side effects. Do not assume every provider connection is in test mode. A receiver test should not require a live transaction.
Finish testing
Disable or remove the temporary endpoint and stop the tunnel. Use a stable HTTPS URL and a separate production signing secret when deploying.
Continue with delivery and retries.