Browser Storage We Use
Our own cookies are set by the application API host (normally api.webhookkit.net); local and session storage belong to the website origin (normally webhookkit.net).
webhookkit_session
Type: HttpOnly, Secure, SameSite=Lax session cookie.
Purpose: Maintains the sign-in flow and your signed-in WebhookKit session, including access to account-owned endpoints. Created when you start signing in.
Lifetime: A browser-session cookie; browsers may restore it when restoring a session. The corresponding server session expires after 7 days of inactivity, or earlier on sign-out, device-session revocation or account deletion.
Category: Necessary for the sign-in you request.
The cookie contains a session identifier, not your email or sign-in provider password.
guest_session_id
Type: HttpOnly, Secure, SameSite=Lax cookie in production.
Purpose: Identifies an anonymous browser session, authorizes access to its unclaimed endpoints and request history across tabs, helps prevent abuse of endpoint creation and lets eligible anonymous endpoints be linked to your account when you sign in. Created when you attempt to create an anonymous endpoint.
Lifetime: Up to 30 days.
Category: Strictly necessary.
The cookie contains a random identifier and does not contain your name or email address.
webhookkit:anonymous-session
Type: sessionStorage
Purpose: Provides a fallback cache of endpoint identifiers, URLs and management credentials for anonymous endpoints created in the current tab. The endpoint list and access are recovered from the API while the guest-session cookie remains valid; this cache is not required for recovery. It does not store captured request bodies. Merely opening the site does not create an empty cache.
Lifetime: Normally until the browser tab or session is closed. When the cached list is updated and contains no anonymous endpoints, the cache is removed.
webhookkit:consent
Type: localStorage
Purpose: Remembers privacy/storage preferences if you save a choice through the preferences interface, when available. Existing choices may be read even when that interface is disabled. Stores the preference version, choice and date; it is not automatically created merely by visiting the site.
Lifetime: Until removed from the browser or replaced by a newer preference.
Category: Strictly necessary.
webhookkit:analytics-visit (optional, when analytics is enabled)
Type: sessionStorage
Purpose: After you allow Analytics in Data preferences, stores a random visit identifier and approved campaign/CTA labels to connect visits, endpoint activation and sign-in events. It contains no account identity, webhook credentials or captured request data. It is not used for fingerprinting or cross-device identification.
Lifetime: Up to 24 hours in the current tab; removed on withdrawal. Closing the tab normally clears it. Analytics events already sent to our database are eligible for deletion after 30 days.
Category: Optional Analytics. Rejecting it does not affect endpoint creation, webhook capture or sign-in.
webhookkit:analytics-withdrawals is necessary session storage used only to complete a withdrawal you requested. It holds pending random visit identifiers, without campaign labels or event data, until the server confirms deletion. Requests are retried after temporary failures and page reloads, including when analytics collection is disabled. Closing the tab normally clears this storage; if browser storage is unavailable, pending requests remain only in memory.
You can withdraw through Data preferences. Withdrawal stops further collection in this tab and requests removal of this visit's events and endpoint associations. Server-side removal requires connectivity; existing associations expire after at most 24 hours. No external analytics provider is used.
Google and GitHub Sign-In
Choosing Google or GitHub sign-in redirects you to that provider. The provider may use its own cookies and browser storage on its sign-in pages under its own policies and your account settings. These are separate from WebhookKit’s session cookie. Opening our sign-in dialog alone does not load a provider sign-in widget.
Cloudflare Turnstile
WebhookKit loads Cloudflare Turnstile when endpoint creation requires additional security verification and when you open the contact form, where a security check is required before sending. Contact form fields and verification tokens remain in memory in the browser; the form does not save them in cookies or browser storage.
Turnstile processes technical information necessary to distinguish legitimate users from automated traffic. Depending on Cloudflare's configuration, it may also use browser-side technical mechanisms required to provide the security challenge.
Turnstile is used only for security purposes and not for advertising or marketing.
Managing Browser Storage
You can delete or block cookies and other stored website data using your browser settings.
Blocking strictly necessary storage may prevent some WebhookKit features from working correctly, including sign-in and anonymous endpoint access and management. Clearing sessionStorage alone does not remove access while the guest-session cookie remains valid. Losing or blocking both the guest cookie and any saved management credentials may prevent you from regaining access. Account-owned endpoints require signing in to their owning account.
Contact
Questions about the use of cookies or browser storage can be sent to:
Dariusz Zbyrad
[email protected]
Optional analytics also covers fixed page/tool actions, endpoint debugging, exports and replay outcomes with consent version 3. Tool inputs/results and credentials are excluded. Tab-scoped webhookkit:analytics-once storage contains only a visit identifier and bounded action/endpoint markers; it clears with withdrawal or visit expiry. Pending withdrawal remains necessary and can contact the configured API while collection is disabled. This is not an analytics cookie or cross-device identity.