Developing against live events locally
One file, no tunnel: forward real signed events to localhost and keep your handler honest.
In short
- Download one file, run it with your API key, and new events arrive at localhost — signed.
- Not a tunnel: it polls and forwards, so nothing on your machine is exposed to the internet.
- Your local handler verifies the same Standard Webhooks headers production will send it.
Run it
curl -sO https://hookget.com/cli/hookget-listen.mjs
node hookget-listen.mjs --key $HOOKGET_KEY --port 3000 --path /webhooksFrom that moment, every new event in your project is POSTed to
http://127.0.0.1:3000/webhooks with webhook-id,
webhook-timestamp and webhook-signature headers. Pass
--secret whsec_… to sign with a secret your handler already knows, or let it mint a
throwaway and print it.
What it prints
› forwarding new events → http://127.0.0.1:3000/webhooks (poll 2000ms)
✓ order.created msg_01M0… → 200
✗ order.refunded msg_01M0… → 500The options
| Flag | What it does |
|---|---|
--types a.b,c.d | Forward only these event types |
--path /hooks | Local path to POST to (default /webhooks) |
--secret whsec_… | Sign with a known secret instead of a throwaway |
--once | Drain what is new, then exit — for scripts and CI |
--api https://… | Point at a different API origin |
Why this is not a tunnel, on purpose. A tunnel parks your traffic on a third-party hostname and opens a path from the internet to your laptop — which is also why security reviews dislike them. Polling forwards the same events with none of that surface. The trade is up to two seconds of latency, which development does not feel.