Suvarnesh K M
Back to projects
Released · v0.1.0 Public MVPDeveloper Tool / Full Stack2026
Creator & Lead Engineer

WebhookLab

Webhook debugging without the guesswork.

Visit Live ProductGitHub Repository
Stack:Next.jsTypeScriptPostgreSQLDrizzle ORMServer-Sent EventsTailwind CSSshadcn/uiVarnusBun

Overview

WebhookLab is a developer-focused webhook debugging platform that provides public HTTP endpoints for capturing incoming requests, persisting them, streaming updates to the dashboard, and inspecting payloads through a developer-oriented interface.

Product Interface PreviewAsset: /public/images/webhooklab-inspection.png
/h/wh_live_8f3a92b
SSE Connected
Interactive Component Inspection (Powered by Varnus Dogfooding):
JSON InspectorInteractive Demo
Object{5}
"status":200
"message":"API request successful"
"developer":Object{4}
"name":"Suvarnesh K M"
"role":"Full-Stack Developer"
"active":true
"location":"India"
"project":Object{4}
"name":"Varnus"
"version":"1.0.0"
"tags":Array[4]
"metrics":Object{3}
"endpoints":Array[2]
"0":Object{3}
"1":Object{3}

Problem

Webhook integrations can be difficult to debug because requests often originate from external services and developers need visibility into exactly what was delivered.

Developers commonly need to inspect:
  • HTTP method & route parameters
  • Request headers & authorization tokens
  • Query string parameters
  • JSON and raw request body payloads
  • Delivery timestamps & latency
  • Retry behavior & signature headers

Solution Workflow

WebhookLab streamlines debugging into a transparent, multi-step pipeline:

1.Create endpoint (/h/[token])
2.Copy webhook URL to third-party service
3.External service fires HTTP request
4.WebhookLab captures & validates payload
5.Persist to PostgreSQL via Drizzle ORM
6.Emit Server-Sent Event (SSE) to dashboard
7.Inspect payload or trigger controlled replay

Technical Architecture

External Service (Stripe, GitHub, Resend, custom webhooks)
       │
       ▼
Public Endpoint: /h/[token]
       │
       ▼
Validation & Rate Limiting Middleware
       │
       ▼
PostgreSQL Storage (Drizzle ORM)
       │
       ├──► Realtime SSE Notification Stream ──► WebhookLab Dashboard
       │                                                 │
       ▼                                                 ▼
Bounded History Retention                        Varnus Inspection Components
                                                         │
                                                         ▼
Controlled Request Replay ──────────────► Validated External Destination

Engineering Details

1. Public Endpoint Tokens

Webhook endpoints use high-entropy public tokens rather than exposing internal database IDs.

2. Request Persistence

Captured request information is stored using PostgreSQL and Drizzle ORM.

3. Realtime Updates

Server-Sent Events update the open dashboard when new requests arrive.

4. Bounded History

Request retention is bounded instead of allowing unbounded storage.

5. Request Inspection

Varnus components are reused for structured developer-facing data inspection.

6. Sensitive Data Redaction

Sensitive HTTP headers are redacted in inspection interfaces.

7. Controlled Replay

Captured requests can be replayed to approved public HTTP(S) destinations with protections against unsafe internal destinations.

8. Rate Limiting

Request ingestion and replay use rate limits to reduce abuse.

Dogfooding Varnus

WebhookLab directly dogfoods Varnus components inside a real developer product, connecting open-source component design with production application requirements:

JSON Inspector

Provides structured, expandable webhook payload inspection with deep tree traversal and copy actions.

Request / Response Viewer

Visualizes HTTP request headers, query parameters, payload body, and outgoing replay responses.

What I Worked Through

  • Incoming request representation: Designing PostgreSQL schemas to store raw headers, query strings, body text, and client metadata cleanly.
  • Persistence vs realtime state: Coordinating synchronous database writes with asynchronous Server-Sent Events (SSE) stream notifications to active browser clients.
  • Bounded request storage: Implementing automatic per-endpoint request bounds to avoid unbounded database growth while preserving recent history.
  • Arbitrary payload safety: Safely rendering third-party JSON and raw request text without script execution or layout overflow.
  • Replay SSRF risks: Validating outgoing replay target URLs against internal subnets and localhost to prevent Server-Side Request Forgery.

Security & Authentication Architecture

WebhookLab implements explicit security boundaries to ensure user data isolation, endpoint integrity, and safe request handling.

JWT & PBKDF2 Auth

Uses HTTP-only JWT cookie sessions powered by jose and Web Crypto PBKDF2 password hashing for session verification and user ownership.

Public Token Model

Endpoints use high-entropy public token slugs (/h/[token]) preventing enumeration of database keys.

Sensitive Header Redaction

Authorization tokens, Bearer headers, and session cookies are automatically masked in inspection views.

SSRF Protection

Replay destinations are validated to reject local IP ranges, loopback addresses, and private subnets.