Webhook / Callback Tester
Get a temporary URL, point a callback at it, and inspect received bodies and retained headers. Built for debugging HiAPI async task callbacks. POST bodies over 64 KiB return 413 and are never stored or truncated; cookies, forwarded/client-IP and ingress-secret headers are not retained.
Anyone who has this URL can read what arrives here, and everything is deleted when it expires. Do not use it for production traffic or sensitive data.
Posts a sample payload to your address from this browser, so you can see the tool work before wiring up a real callback.
Response the sender gets
Change this to test retries: return a non-2xx status and HiAPI will retry the callback, so you can watch the schedule in the list.
Requests
Waiting for the first request…
Point your callback at the URL above, or send a test request to see how it looks.
Request detail
Select a request to see its headers and body.
Create a task with this callback
Copy this, replace the key and the model, and run it.
curl -X POST https://api.hiapi.ai/v1/tasks \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "happyhorse-1.0",
"callback": { "url": "https://www.hiapi.ai/api/tools/webhook-tester/hook/YOUR_TOKEN", "when": "final" },
"input": { "prompt": "a cyan glass data center entrance", "duration": 5, "resolution": "720p" }
}'What this tool cannot do
- It compares HiAPI HMAC consistency only, not freshness or replay protection, and a match alone cannot prove origin. Without a sign key a callback looks like any other POST.
- Bodies over 64 KiB return 413 and are never stored or truncated. Cookies, forwarded/client-IP and ingress-secret headers are not retained.
- Replay is not an exact original request. Headers are stripped, and CORS, mixed-content or local-network rules can block it; localhost access is not guaranteed.
- It cannot look up tasks. It only receives payloads, so it has no access to task status, balance or artifacts.
- It is not permanent storage. The address and its contents are destroyed after 24 hours, so do not send production or sensitive data.
- The URL is a credential. Anyone who has it can read what arrives.
- A localhost target never receives a real HiAPI callback, because HiAPI has to reach it over the public internet.
How to test a webhook in three steps
01Copy your temporary URL
Open this page and copy the address it gives you. It stays alive for 24 hours and accepts a POST from any source.
02Point your callback at it
Pass it as callback.url when you create an async task on api.hiapi.ai, or use the Send a test request button to fire one straight away.
03Read the request
Requests appear as they arrive. Inspect headers, body and content type; paste your webhook sign key to check the signature locally.
Webhook tester FAQ
What is a webhook tester for?
A webhook tester gives you an address that accepts incoming HTTP requests and shows retained headers and the body. Cookies, forwarded/client-IP and ingress-secret headers are dropped. Bodies over 64 KiB return 413 and are never stored or truncated. It saves you from standing up a server just to inspect a callback.
How do I test a HiAPI callback?
Create a task on api.hiapi.ai/v1/tasks and pass this page's URL as callback.url. When the task reaches a terminal state HiAPI POSTs the result here, and the request shows up in the list.
Why does the callback not arrive when I test against api.hiapi.ai locally?
A callback has to be reachable from the public internet. Your own machine usually is not, so a localhost address will never receive a real HiAPI callback. Use a URL on a public host — this page gives you one.
Can I verify that a callback really came from HiAPI?
With a webhook sign key, this tool recomputes HMAC-SHA256 over the retained body and X-HiAPI-Timestamp and compares X-HiAPI-Signature locally. A match shows consistency with that key, not freshness or protection against replay. Without a sign key there is no signature to compare.
Is my webhook sign key sent to your server?
No. The key is used only in your browser's crypto API to recompute the signature. It is never transmitted, stored or logged, and the request that reaches our server does not carry it.
How long does the address last, and what happens to the data?
The address and everything it received are deleted after 24 hours. Each address keeps up to 50 requests. Treat the URL as a credential: anyone who has it can read what arrived, so do not use it for production or sensitive data.
Can it tell me how often HiAPI retries a failed callback?
Yes, and that is the reason the response status is configurable. Set the response to 400 or 500, trigger a real task, and the arrival times in the list show you the retry schedule. Retries fire immediately, then at +1, +5 and +20 minutes, four attempts in total.
Can I replay a request?
Replay makes a best-effort request from your browser, not an exact copy. Cookies, authorization, proxy/platform and browser-controlled headers are not forwarded, and redirects are rejected. The target must allow CORS; HTTPS-to-HTTP mixed content and browser local-network rules can block it. Localhost may work but is not guaranteed. A blocked response does not prove the target received nothing.