HookspectorOpen app

Hookspector FAQ

What is Hookspector?

Hookspector is a free, browser-based Shopify webhooks tester at https://www.hookspector.xyz. It gives you a unique endpoint that receives webhooks in real time, lets you inspect headers and payloads, and verify Shopify’s HMAC signature.

How does Hookspector work?

  • Open the site and you’ll automatically get a unique webhook URL.
  • Point your Shopify webhook to that URL.
  • When Shopify sends a webhook (or you send a test from the admin), the event appears instantly in Hookspector.
  • Click any event to view HTTP headers and JSON payload; copy either to your clipboard.

Is it really free?

Yes. Hookspector is free to use. We built it in-house while developing the Cloudhooks app for Shopify and released it publicly because it proved widely useful.

Do I need to create an account?

No account is required. Your endpoint is assigned on first visit and tied to your browser via local storage/cookies.

Will my webhook endpoint persist?

Yes. Your endpoint is preserved across sessions in the same browser unless you clear cookies/local data or use a private/incognito window, or have a setting that deletes site data on close.

How do I use Hookspector to test Shopify webhooks?

  1. Visit https://www.hookspector.xyz and copy your unique endpoint URL.
  2. In Shopify Admin, go to Settings → Notifications → Webhooks.
  3. Create a new webhook (or edit an existing one) and paste your Hookspector URL.
  4. Click “Send test notification” from the … menu to send a sample payload.
  5. Watch the event appear instantly in Hookspector and inspect headers/payload.

Tip: For real data, trigger the actual store action (e.g., create a test order for orders/create).

Which Shopify headers and fields can I see?

You’ll see the full request headers and body, including useful Shopify headers such as:

  • x-shopify-api-version
  • x-shopify-event-id
  • x-shopify-hmac-sha256
  • x-shopify-shop-domain
  • x-shopify-test
  • x-shopify-topic
  • x-shopify-triggered-at
  • x-shopify-webhook-id

Headers vary by topic and Shopify updates.

Can Hookspector verify Shopify’s webhook signature (HMAC)?

Yes. Set your Shopify webhook signing secret in Hookspector. For authentic requests you’ll see a green checkmark; unverifiable requests show a red warning.

Where do I find the Shopify signing secret?

  • Store-managed webhooks: Settings → Notifications → Webhooks → Edit → the secret is shown when you manage webhooks (or generated when creating).
  • App-managed webhooks: In your app configuration (Partners Dashboard or app code). Use the same shared secret that Shopify uses to compute X-Shopify-Hmac-Sha256.

What counts as a successful verification?

Shopify signs the raw request body using HMAC-SHA256 with your shared secret. Hookspector recomputes that HMAC and compares it to X-Shopify-Hmac-Sha256. A match = verified.

Can I send webhooks from the command line?

Yes, but note that Hookspector doesn't support local development workflows with the Shopify CLI. However, you can send webhooks directly using curl or any HTTP client:

curl -X POST \
  -H "Content-Type: application/json" \
  -H "X-Shopify-Topic: orders/paid" \
  -H "X-Shopify-Shop-Domain: yourstore.myshopify.com" \
  -H "X-Shopify-Hmac-Sha256: <computed signature>" \
  -d '{"id":1234,"email":"[email protected]"}' \
  https://www.hookspector.xyz/webhook/your-endpoint

Replace your-endpoint with your actual Hookspector endpoint ID. The webhook will appear instantly in your browser.

Does Hookspector work on mobile devices?

Yes. Hookspector is optimized for mobile. You can generate endpoints, receive events, inspect headers/payloads, and verify signatures from your phone or tablet.

Can I copy payloads and headers?

Yes. Open any event and use the copy controls to copy payload and/or headers to your clipboard for quick reuse in tests or documentation.

Does Hookspector support multiple webhook topics?

Yes. You can direct any number of Shopify topics to your Hookspector URL. Events arrive chronologically and list their topic so you can filter by what you’re testing.

What are the best ways to run a Shopify webhooks test?

  • From Shopify Admin: Send a test notification (great for quick plumbing checks).
  • By real actions: Trigger the actual event (e.g., update a product to test products/update).

Combining methods gives you coverage for both wiring and real-world payloads.

Why would I use Hookspector instead of rolling my own endpoint?

  • Instant endpoint—no deployment needed.
  • Clear, side-by-side headers and payload view.
  • One-click copy to clipboard.
  • Built-in HMAC verification.
  • Works anywhere (desktop/mobile) and is free.

It’s a fast, zero-setup Shopify webhooks tester for local dev and store QA.

Troubleshooting: I’m not seeing events in Hookspector

  • Confirm the webhook URL in Shopify exactly matches your Hookspector URL.
  • Send a “test notification” from Shopify to rule out topic/action issues.
  • Ensure your browser didn’t rotate/forget the endpoint (incognito/private mode will).
  • Check that the webhook is active/enabled in Shopify.
  • Make sure you’re triggering the correct event (e.g., orders/create vs orders/paid).
  • Verify your store/app permissions include the topic you’re testing.
  • If using the CLI, confirm the address parameter is your Hookspector endpoint.

Do you store my data?

No. Hookspector has no persistent storage. When a webhook arrives at your endpoint, our server forwards it directly to your open browser tab in real time. Nothing is saved on our servers. Once you close your browser, the webhook data is gone. That said, avoid sending sensitive PII in test payloads unless necessary. If you have strict compliance requirements, consider sanitizing payloads before testing or using a dedicated internal endpoint.

Any limits or quotas?

Hookspector is a free utility. For heavy automated testing, be considerate and keep volumes reasonable. If you need sustained high-volume capture or retention, consider our Cloudhooks app for production-grade automation.

Can I use Hookspector with non-Shopify webhooks?

Yes. While designed for Shopify, Hookspector will display any HTTP POST with JSON payloads and headers sent to your unique URL. Signature verification is specialized for Shopify’s HMAC header.

How can I find Hookspector again later?

Search for "Shopify webhooks test" or "Shopify webhooks tester" in Google, or bookmark https://www.hookspector.xyz directly.

Who made Hookspector?

Hookspector was built by the team behind Cloudhooks, a Shopify automation app. We released it publicly because it saves time when wiring and debugging webhook integrations.

Quick start checklist (TL;DR)

  • Open Hookspector → copy your unique URL.
  • Add/edit a webhook in Shopify → paste the URL.
  • Send “test notification” or trigger a real event.
  • Inspect headers/payload in Hookspector.
  • Paste your signing secret in Hookspector to verify HMAC.

Need production-grade automations after testing? Check out Cloudhooks for building event-driven workflows in Shopify.