Reference
Privacy & Security
Understand receiving URL and history access boundaries. Use synthetic data, account for unredacted captures and distinguish deletion from backup retention.
On this page
Receiving URL access
The public receiving URL accepts deliveries. The workspace URL opens the inspector in your browser. Copy Webhook URL in the workspace for your sender; do not send to the browser address. A receiving token or workspace UUID alone does not grant history or management access.
Anyone with the receiving URL can send traffic, so protect its token against unsolicited deliveries and abuse. History requires valid guest management access or the owning account session. Signing out or clearing browser storage may remove access; do not rely on the URL as a recovery credential.
Sensitive data
Use synthetic data for temporary debugging. Bodies, headers and query parameters can contain credentials, personal information and cookies; captures are persisted remotely without automatic redaction. Avoid production secrets and permanent secret storage.
Downloads and exports contain unredacted data too. Review files before sharing and remove sensitive data from bug reports.
Signature validation
Capture preserves incoming bytes and headers but does not verify provider signatures or execute your application handler. A signature header in the inspector does not establish authenticity. Use the sender’s verification procedure in your own handler with a test secret.
Deletion and backups
Request deletion removes the chosen record from the active database. Delete captured requests clears endpoint history; Delete endpoint also stops receipt. Retention cleanup and endpoint expiration are separate processes. Account deletion must not be assumed to erase all payload content.
Existing backups and restore limitations are described in the Privacy Policy. Read the Terms of Service for service and user responsibilities; do not assume immediate removal from every copy.
Browser tools
The developer tools process their input locally in your browser, unlike webhook capture that stores requests remotely. Local processing does not mean the entire site makes no network or analytics requests.
JWT decoding alone does not verify a signature. Use the tool’s explicit verification function and trusted key material when verification is needed.