Hookbase for VS Code

Debug webhooks without leaving the editor. Catch them on a stable public URL, forward them to localhost, watch every delivery as it happens, and replay the one that failed (edited, if you like) until your handler gets it right.

Works with Hookbase. You can try the request bin without an account.

Try it in thirty seconds

Open the Hookbase sidebar and click Create Request Bin. You get a public URL that records everything sent to it for 24 hours, and you don't need to sign up. Point a Stripe, GitHub or Shopify webhook at it, or paste the sample curl into a terminal. Each request appears in the view. From there you can:

• open it to see the exact method, path, headers and body;
• replay it to your local server as many times as you need;
• set the status the bin answers with, to watch the provider retry.

To walk through the rest, run Welcome: Open Walkthrough… and pick Get Started with Hookbase.

Your local server, on a URL that doesn't change

Hookbase: Start Tunnel forwards a public URL to a port on your machine.

• Each workspace keeps its tunnel. Stopping it only disconnects. The next start reconnects to the same address, so the webhook settings at your provider keep working. If the tunnel is live in another window, the extension asks before taking it over.
• Tunnel Requests shows every forwarded request with full headers and bodies, plus Copy as cURL and Replay to localhost. Both always target localhost on your tunnel port, whatever path a caller sent.
• Configure Tunnel Filter forwards only the sources, event types or payloads you care about.
• Manage Tunnels lists your tunnels and lets you reassign them, delete old ones, or create one with a custom subdomain.
• You get a notification when your server returns a 5xx or can't be reached.

When a delivery fails

• Live Activity streams webhooks as they arrive and deliveries as they finish, starting with the recent history. Click any row to open the delivery.
• The delivery panel shows what Hookbase sent, what came back, and where the time went, in Request, Response and Timeline tabs.
• Delivery statuses are pending, delivered, failed, failed_over, schema_failed and throttled, each with its own icon. Credentials in the panel's Raw tab are masked.
• Analyze Failure gives the likely cause, the evidence for it, and a suggested fix.
• Replay with Changes… opens the received payload in an editor. Edit it, then send it through the route again, optionally to a different destination. If the source masks or encrypts fields, the draft shows them masked or decrypted, so only the fields you changed are sent and applied to the stored payload; the rest keep their real values.
• Diff Payload compares what arrived with what was delivered. Export HAR writes the exchange to a file that DevTools, Charles and Proxyman can open.
• Failure Clusters groups failures by cause, so 400 identical errors are one row. You can replay a whole cluster at once.
• Dead Letter Queue lists deliveries that won't be retried again. Select any number and retry or discard them together.
• Filter Deliveries and Filter Events narrow the views. For example, status:failed source:stripe payload.data.object.id:"ch_123" works in one box.
• Routes show their circuit-breaker state. Reset Circuit closes a tripped one.

Ask @hookbase

In Copilot Chat:

In agent mode, Copilot can also use four Hookbase tools on its own: list recent deliveries, read a payload, explain a failure, and replay (it asks you first).

When a delivery id turns up in a log, an output channel or a pasted terminal line, the lightbulb offers Explain This Failure.

The hosted Hookbase MCP server is registered for you, so it appears under MCP: List Servers.

Build the pipeline from the editor

• New Source, New Destination and New Route are wizards. The required fields come first, then one list of optional settings: signing secrets, rate limits, IP filtering, deduplication, auth, headers, timeouts, filters, transforms, schemas, failover and notifications.
• New Source follows the provider catalog. It asks for the signing secret only when the provider issues it, and shows a Hookbase-generated secret once, with a copy button.
• Edit… changes one setting at a time, on sources, destinations, routes and cron jobs.
• Reveal or Rotate Signing Secret works on sources. Rotation always asks first.
• Send Test Event sends an event through the real ingest path, signed with the source's own secret. It asks you to confirm first, because it creates a real event. The payload can come from the provider's catalog, a template, a past event, an open editor or a file.
• The transform playground keeps transforms as files under .hookbase/transforms/. Test Transform runs one against a payload and shows engine errors as squiggles. Test Filter and Validate Against Schema do the same for filters and schemas.
• Compute Signature and Verify Signature sign or check the active editor's bytes with any provider's scheme. Compute Signature copies every header the scheme signs. Verify Signature asks for the timestamp, and for the message id on Standard Webhooks/Svix, when the provider sends them in their own headers (the id needs an API that lists idHeader).
• Mock Destination Response makes a destination answer 500, 429 or a slow 200, so you can watch retries and the circuit breaker safely.

Outbound webhooks

If you use Hookbase to send webhooks to your own customers, run Configure Views and turn on these views:

• Outbound Applications: applications, their endpoints and subscriptions. Endpoints have Send Test Event, Reset Circuit, Replay Failed Messages and Rotate Signing Secret.
• Outbound Messages: every message, with each attempt. Failed ones can be replayed.
• Event Types: your event catalog.

Send Outbound Event from Editor sends the open JSON file to every subscriber, or to a single application.

Live Activity shows outbound messages and their attempts next to inbound deliveries, marked with an envelope icon. Click one to open the message and its attempts.

More views

Configure Views also adds Events, Transforms, Filters, Schemas, Dead Letter Queue, Outbound DLQ and Cron Jobs. Cron jobs have Run Now, Pause, Activate, Edit… and Delete, and each one expands into its recent runs. These views are off by default so the sidebar stays scannable.

Signing in

Sign In opens your browser and confirms a short code. If you belong to several organizations, click the status bar item and choose Switch Organization. For CI or a self-hosted install, use Sign In with API Key with a whr_… key. Both kinds of credential are kept in VS Code's Secret Storage.

Keyboard shortcuts

Hookbase binds a Ctrl+Alt+H chord, then a second key:

On many Windows keyboard layouts, Ctrl+Alt is the same as AltGr, so the first key of a chord can swallow a typed h. If that happens, open Preferences: Open Keyboard Shortcuts, search for hookbase, and change or remove the binding.

Settings

To see more detailed logs, run Developer: Set Log Level… and choose Hookbase.

Requirements

• VS Code 1.101 or later, or a compatible editor such as Cursor or VSCodium (via Open VSX). Desktop only: the tunnel needs a real socket to localhost, which vscode.dev and github.dev can't provide.
• GitHub Copilot Chat, for @hookbase and the language model tools. Everything else works without it.

In an untrusted workspace, the extension reads the API URL, the MCP transport, and the tunnel's port, filter and auto-start from your user settings, never from the workspace.

Privacy

The extension sends no telemetry. It talks only to the Hookbase API you point it at. Your sign-in stays in VS Code's Secret Storage.

License

MIT.