Live, no reload.
Every request appears in the list as soon as it's received. If the connection drops, the page reconnects on its own and catches up on anything it missed.
Webhook & HTTP request inspector
Watch every webhook arrive, live.
A single URL receives all your HTTP requests — method, headers, query, body — and shows them the instant they arrive. No account. Every request is encrypted, then erased after 24 h without activity.
No sign-up
curl -X POST https://tracehook.dev/h/<your-id> -H 'Content-Type: application/json' -d '{"hello":"world"}'Interface preview: a list of received requests on the left, the detail of the selected request on the right with the Overview, Headers, Query, Body and Raw tabs.
The request exactly as it arrived.
Headers in the order received, query, formatted and colored JSON body, forms, binary as hex. You see what the provider actually sent, not what its docs promise.
Your payloads don't linger.
No account, so nothing ties you to your data. Access hinges on a random identifier. Every request is encrypted before storage and everything is erased 24 h after the last activity. You can also delete it all in one click.
Illustration: the session interface rotates to show the request list, then the detail panel, then the lock and countdown.
Every method
GET, POST, PUT, PATCH, DELETE, OPTIONS… and any sub-path.
Copy as cURL
Replay the exact request from your terminal.
JSON export
Download a request for a test or a ticket.
Search & filters
By method or by text.
Last 50 requests
The oldest are dropped automatically.
Up to 1 MiB per request
Headers and body included.
Light, dark, system
The interface follows your OS.
Keyboard
↑ / ↓ to move through requests.
Optional password
Lock a session: the link alone is no longer enough to read it.
Built-in abuse protection
Per-IP rate limits, so the service stays available for everyone.
CORS on capture
Send requests from the browser: the capture route accepts cross-origin calls.
Rate-limit headers
RateLimit-Limit/Remaining/Reset and Retry-After on every throttled response.
Built for payloads you don't want lying around.
Encrypted at rest. Every request is encrypted (AES-256-GCM) before being stored.
Ephemeral. Erased 24 h after the last activity. Deletable immediately.
Nothing is executed. Received content is displayed as text, never interpreted by the browser.
No reflection. The capture URL never returns what it received.
Lockable. Add a password if the link might get forwarded: only an encrypted verifier is kept, never the password. Capture keeps working, only reading is blocked.
Illustration: an encrypted request whose content is only readable under a magnifying glass, then erased after 24 h.
Frequently asked questions
Do I need an account?
No. Your session's URL is your only access: keep it to yourself.
How long are my requests kept?
Up to 24 h after the last activity on the session. After that, everything is deleted.
How many requests per session?
The last 50. Older ones are deleted automatically.
What's the maximum size?
1 MiB per request, headers included. Beyond that, the request is refused (HTTP 413).
What does the capture URL respond?
A 200 JSON { "ok": true, "id": "…" }.
Are there rate limits?
Yes, to protect the service. If you hit them, you get a 429 with Retry-After.
Can I protect my session?
Yes, with an optional password. Without it, nobody — even with the link — can read the content. It's never stored in plain text and can't be recovered if you forget it.
Your next webhook — you'll read it live.
No sign-up
Three steps. No setup.
Create a URL.
One click. You get a unique address, for example
https://tracehook.dev/h/3f2c….Send it requests.
Paste the URL into your provider's webhook config, or test it right away: .
Read everything, live.
Method, path, headers, formatted query, body. Copy the request as cURL to replay it. .