Give a difficult webhook a reproducible local workbench.

A callback arrives. A field changed. Your handler rejected a signature. You want to inspect the exact bytes and replay deliberately against your local code—not guess from a screenshot of a log.

PayloadDesk is a ready-to-run, single-user local webhook review studio with original editable Python, SQLite and vanilla-browser source. It is designed for developers and small agencies who want a self-contained inspection and replay toolkit on their own machine.

Important scope: this is localhost software, not a hosted public webhook endpoint. External providers cannot reach your localhost directly. Public ingress, tunnels and reverse-proxy deployment are not included or supported. Replay destinations are deliberately restricted to literal http://127.0.0.1 addresses on non-privileged ports; this is not an internet request sender or a production delivery gateway.

What you can actually do

• Create named sources with unique capture paths; receive local POST, PUT and PATCH requests.
• Review retained events, request metadata, exact payload bytes and best-effort-redacted headers in a browser inbox.
• Check optional raw-body HMAC-SHA256 signatures and retain invalid/missing-signature evidence. This is not universal provider-specific signature verification or Stripe timestamp verification.
• Compare two JSON payloads using structural, path-level differences. Non-JSON bodies are compared by bytes/hash rather than a fabricated JSON diff.
• Manually replay an event to a permitted localhost receiver, optionally regenerate the configured raw-body HMAC, and retain the actual response or connection error. Original credentials are not forwarded.
• Export request evidence as JSON and a spreadsheet-safe summary CSV; print the selected event as a clean browser report.
• Start with clearly fictional sample data, a working echo receiver and a signed fixture sender.

Included in the buyer ZIP

1. Complete editable Python standard-library application and vanilla HTML/CSS/JavaScript interface.
2. SQLite-backed local history and source configuration.
3. Working fictional sample workflow, local receiver and signed sender examples.
4. Setup, user, API and security-boundary documentation.
5. Runnable regression tests and a one-business commercial-use source licence.

The separate free demo is a read-only fictional sample, not the working paid application. Promotional previews show the actual application with fictional data; decorative staging is illustrative and no physical hardware is included.

Requirements and practical limits

Install Python 3.10+ and use a modern desktop browser. No pip/npm packages, hosted account or external API key is required for the application's local runtime. The app binds only to 127.0.0.1.

Maximum captured body: 256 KiB. History retains the latest 1,000 events, removing older events and their replay records. Replay response capture is limited to 16 KiB, with a 3-second socket timeout. Structural JSON comparison is capped at 100 differences and 32 nesting levels. Replay is manual; there are no background retries or delivery guarantees.

Data is stored locally without encryption. Header redaction is best effort: payloads and arbitrary custom headers may still contain sensitive data. Keep the local admin token, capture URLs, data folder and exported evidence private. This is a development tool, not a certified security product.

Licence and price

US$89 one-time for this release and its source. One buyer business may use it on its own machines for internal work and its client-development projects; generated reports may be used commercially. Source resale, general redistribution, sublicensing and a multi-tenant hosted service are not included. No hosting, public tunnel, ongoing support or future-update entitlement is promised.

There are capable free webhook tools and more extensive hosted subscriptions. PayloadDesk is for buyers who specifically value an editable, self-contained local capture/review/diff/replay source toolkit; it does not claim feature parity with those hosted platforms or guarantee commercial results.

Release checks: 18 backend regression tests and 43 real Chromium workflow checks passed on Ubuntu, including real local HTTP capture and replay. Windows/macOS commands are documented but native operation was not independently exercised.