Live webhooks · ntfy.sh relay
Order updates from webhooks
Play the payment provider, the warehouse and the courier. Every event you press goes out as a real webhook, through a free relay, to the shop's back office, which checks it and acts on it. Then make it go wrong.
Webhook demo
The other systems
Things happen in the systems the shop relies on. Press one to make it happen, and that system sends a webhook to the back office's address.
What the senders did
- Nothing sent yet.
The shop's back office
It gave each system this address and a list of events it wants to hear about. It never asks: it waits to be told.
https://ntfy.sh/dh-orders-… Needs JavaScriptInbox
- Nothing yet. Press an event under "The other systems" and it lands here.
0 requests the back office would have made by now if it asked every 5 seconds instead
0 webhooks it has received, each one the moment something happened
Try it from elsewhere
Send one from your phone
The address is real, so a webhook can come from anywhere. Open this page on another device with the link below and press an event there: it lands in this inbox too. Or send one from a terminal.
Your link
…
You opened a shared link, so this page sends to and listens on the same address as the page that shared it.
From a terminal
…This one has no signature, so the back office won't act on it. Watch it arrive anyway.
Behind the scenes
One event, one delivery
This is the last webhook the back office received, exactly as it arrived, and what it checked before doing anything.
Subscribe, once
Before anything happens, the back office tells each system where to send updates, which events it wants and a shared secret for signing them. After that, it doesn't make a single request.
- An address that's always listening
- Only the events it needs
- A secret, so it can tell real deliveries from fakes
The delivery
A
POSTwith a JSON body. The ID makes each event unique, and the signature proves who sent it.POST /dh-orders-example Content-Type: application/json Webhook-Id: evt_7k2m9q4x Webhook-Signature: sha256=3f1c…a90b { "id": "evt_7k2m9q4x", "type": "payment.succeeded", "created": "2026-11-06T10:05:12.000Z", "data": { "order": "DH-1042", "amount": "48.50", "currency": "GBP", "method": "card" } }Check, then act
A good receiver checks before it trusts anything, then replies quickly so the sender doesn't try again.
- Signature matches the shared secret
- Subscribed to
payment.succeeded - New event ID, not seen before
- Order confirmed: the confirmation email goes to the customer
A static site like this one can't receive a webhook itself, so the address belongs to ntfy.sh (opens in a new tab), a free relay that needs no key. It passes each message straight on to this page. It passes on the message but not the HTTP headers, so the page packs the headers into the message and unpacks them on arrival. If the relay doesn't answer, the page plays both parts itself and says so above.