Test webhooks & APIs.
Both ways.
Catch what apps send to you, mock the APIs your app calls, or fire a request at any webhook or API and see exactly how it answers. Live in your browser, gone in 10 minutes.
- inboxes created
- —
- requests caught
- —
- webhooks tested
- —
- live right now
- —
- Stripe
- GitHub
- Shopify
- Slack
- Discord
- Microsoft Teams
- Google Chat
- Telegram
- Zapier
- n8n
- Make
- PayPal
- GitLab
- HubSpot
- Jira
- Linear
- Notion
- Airtable
- Vercel
- Netlify
- Cloudflare
- Supabase
- Firebase
- Postman
- Mattermost
- WooCommerce
- Square
- Sentry
- PagerDuty
- Typeform
- Calendly
- Trello
- IFTTT
- + any REST API
Webhook or API? Same wire, different direction.
Both are plain HTTP requests that get a response. The only difference is who starts the conversation, and bot-msg can stand in on either side.
Testing an API?
Use Send to call it: any method, headers and Bearer token. Or use Receive as a mock API, so your app talks to bot-msg and you see exactly what it sends.
Testing a webhook?
Use Receive to catch what a service sends you. Use Send to fire a (signed) webhook at your own endpoint and check how it reacts.
What people use it for
Jobs where a throwaway endpoint or a one-off test request beats wiring up a local tunnel or a full API client.
See what a payment provider really sends
Point a Stripe or Mollie test webhook at an inbox and read the actual payload and headers before you write the handler.
Create an inbox → SendCheck that a chatbot webhook still works
Paste your Slack, Discord or Teams webhook URL and fire a message. A 200 or 204 means it's alive; anything else tells you why not.
Test a chat webhook → SendProve your app checks signatures
Send a correctly signed request, then one with the wrong secret. Your endpoint should accept the first and reject the second.
Send a signed request → ReceiveMock an API your app depends on
Point your app at an inbox in place of the real API. See every call it makes, then answer with a 500 or a 5-second delay to test error handling.
Create a mock endpoint → SendCheck that a REST endpoint responds
Call an API with a Bearer token and read the status, headers, JSON body and timing, without installing an API client.
Call an API → ReceiveAssert on webhooks in CI
Create an inbox from your test suite, trigger your app, then read back what arrived through the JSON API. No browser needed.
See the API →How each direction works
No install, no account, no tunnel. Everything disappears on its own.
- Create an inbox: you get an endpoint URL, a signing secret and a private dashboard link.
- Point any app or service at the endpoint, as a webhook URL or as the base URL of a mock API. Optionally set the reply it gives.
- Watch requests land live, with pretty JSON, all headers, signature check and copy-as-curl.
- Pick a preset (REST API, Bearer-token API, Slack, Discord, Teams, Telegram, GitHub, Stripe) or build your own.
- Paste the webhook or API URL, tweak method, headers and body, and optionally sign it.
- Send and read the exact status, headers, body and timing that came back.
Everything you need to debug a webhook or API integration
Find out what a service actually sends, and how an endpoint actually answers.
Live stream
Requests show up in your dashboard within a second or two of landing. No refresh button.
Test any webhook or API
REST APIs with Bearer tokens, plus presets for Slack, Discord, Teams, Google Chat and Telegram. Or build any request by hand.
Signatures, both ways
Sign outgoing requests GitHub-, Shopify- or Stripe-style. Verify incoming ones automatically.
Mock API endpoints
Let an inbox stand in for a real API: choose the status code, body and delay it replies with, to test retries, timeouts and error paths.
Self-destructing
10 minutes by default, +60 min when you need it. At zero, every captured request is wiped for good.
Private by design
Unguessable addresses, a separate read key, never listed anywhere. Nobody stumbles into your inbox.
Automate bot-msg with its own API
Everything the dashboard does, your test suite can do too: create inboxes, read what arrived, send test requests. Authenticate owner calls with Authorization: Bearer <inbox key>.
| POST /api/inboxes | Create an inbox. Optional body {"label":"ci","minutes":30}. |
| ANY /h/:id/* | The capture endpoint. Anything you send is recorded. |
| GET /api/inboxes/:id | Inbox info, secret, settings and expiry. |
| POST /api/inboxes/:id/extend | Add 60 minutes (max 2 hours left). |
| PATCH /api/inboxes/:id | Update settings: requireSecret, response. |
| GET /api/inboxes/:id/messages | List requests, newest first. ?full=1 includes headers and body. |
| DELETE /api/inboxes/:id | Destroy the inbox now. |
| POST /api/send | Send a test request to a webhook: {"url","method","headers","body","sign"}. |
# 1. create an inbox (prints id, key, secret, endpoint) curl -s -X POST https://bot-msg.com/api/inboxes \ -H 'content-type: application/json' -d '{"label":"ci","minutes":30}' # 2. send it something curl -X POST https://bot-msg.com/h/ci-x7k2m9q4p3wz/orders \ -H 'content-type: application/json' \ -d '{"event":"order.created","id":1234}' # 3. read it back curl -s 'https://bot-msg.com/api/inboxes/ci-x7k2m9q4p3wz/messages?full=1' \ -H 'authorization: Bearer bmk_...'
FAQ
What is bot-msg.com?
A free tool for testing webhooks and APIs in both directions. Receive: get a throwaway URL (or mock API endpoint) and watch every request that apps send to it, live. Send: fire a test request at any webhook or API, like Slack, Discord, Teams or your own REST API, and inspect the response.
What's the difference between a webhook and an API?
Both are HTTP requests with a response. The difference is who starts the conversation: with an API, your app calls a service to ask for something. With a webhook, the service calls your app when something happens. A webhook is really a small API that your app exposes for someone else to call. See the diagram.
Can I test APIs too, not just webhooks?
Yes. The tester sends GET, POST, PUT, PATCH and DELETE requests with any headers, including Bearer tokens, to any public REST API. And an inbox can act as a mock API: point your app at it and choose the status code, body and delay it answers with.
Can I test my Slack, Discord or Teams webhook?
Yes. Open the webhook tester, pick the Slack, Discord, Teams, Google Chat or Telegram preset, paste your webhook URL and hit send. You'll see the status code, headers, body and response time.
Do I need an account?
No. There's no sign-up and no email address. Inboxes are created in one click and delete themselves.
How long does an inbox last?
10 minutes by default, or 30 or 60 if you choose. A countdown shows the time left, and you can extend it by 60 minutes at a time. When it hits zero the inbox and every captured request are permanently deleted.
Can other people see my inbox?
No. Every inbox address ends in a random 12-character code, and reading it requires a separate private key that only lives in your inbox link. Inboxes are never listed anywhere. The activity notices on this page only ever show a country, never an address.
Can I test webhook signatures?
Yes, both ways. Inboxes verify HMAC-SHA256 signatures on incoming requests, and the webhook tester can sign outgoing requests in GitHub, Shopify, Stripe or plain-hex format, so you can check that your app accepts valid signatures and rejects bad ones.
Pick a direction.
Both are free, both take one click, and both are gone when you are.