Skip to content
WebhookKit

Guides

Testing GitHub Webhooks

Connect a test repository webhook to WebhookKit. Inspect ping and subscribed events, compare GitHub delivery results and understand signature limitations.

On this page

Reduced synthetic repository setup ping, not a push event. zen is GitHub's ping message; hook_id and hook describe the configured webhook; repository and sender identify the synthetic context. X-GitHub-Event identifies ping, X-GitHub-Delivery identifies this delivery, X-GitHub-Hook-ID identifies the hook and User-Agent identifies Hookshot. X-Hub-Signature-256 is conditional on configuring a secret; this demonstrative placeholder is cryptographically invalid. Capture alone does not verify authenticity or run application logic.

HTTP
content-type: application/json
user-agent: GitHub-Hookshot/synthetic
x-github-hook-id: 123456
x-github-event: ping
x-github-delivery: 00000000-0000-4000-8000-000000000003
x-hub-signature-256: sha256=ILLUSTRATIVE_NOT_VALID

{
  "zen": "Synthetic setup ping",
  "hook_id": 123456,
  "hook": {
    "type": "Repository",
    "id": 123456,
    "name": "web",
    "active": true,
    "events": [
      "push"
    ],
    "config": {
      "content_type": "json",
      "insecure_ssl": "0",
      "url": "https://receiver.example/e/synthetic"
    }
  },
  "repository": {
    "id": 123,
    "name": "synthetic-repo",
    "full_name": "synthetic-owner/synthetic-repo",
    "private": false
  },
  "sender": {
    "login": "synthetic-owner",
    "id": 456,
    "type": "User"
  }
}

Create a test endpoint

Use a test repository and an account with repository owner or admin permission to manage its webhooks. Create an endpoint and copy the receiving URL. No local server is required.

Configure GitHub

Open repository Settings → Webhooks and add a webhook. Enter the receiving URL as the Payload URL, choose application/json, select the events you want and keep the webhook active. A high-entropy secret is optional for this capture test; if you add a test secret, GitHub also sends X-Hub-Signature-256. Keep TLS verification enabled.

See GitHub’s webhook setup guide for current controls. Use test secrets only; WebhookKit does not verify the signatures produced by a configured secret.

Trigger an event

Click Add webhook. GitHub immediately sends the selected example: a ping confirming webhook setup. Review that delivery result; later, you can separately trigger a subscribed event. See GitHub’s testing guide.

Inspect the delivery

A new WebhookKit endpoint returns HTTP 200 by default. Select the matching POST and inspect zen, hook_id, hook, repository and sender. Compare X-GitHub-Event, X-GitHub-Delivery, X-GitHub-Hook-ID and User-Agent with GitHub’s delivery record. X-Hub-Signature-256 is present only when a secret is configured; its presence is not verification.

A successful capture proves receipt and persistence, not signature authenticity. WebhookKit does not execute your repository event handler or any application business logic.

Common mistakes

Check for a workspace URL used as Payload URL, an expired endpoint or an unsubscribed event. If the body is form-encoded instead of the expected JSON, check GitHub’s content-type setting. GitHub redelivery is distinct from automatic retries; do not assume failed events will automatically arrive again.

GitHub currently does not automatically redeliver failed deliveries. A repository admin can manually redeliver an eligible delivery from the past three days. Follow the retry testing guide and GitHub’s linked redelivery instructions for the current policy.