Debugging Webhooks

Most webhook problems fall into one of two categories: the event never arrived at the ingest URL, or it arrived but wasn't delivered to your endpoint. The dashboard tells you which one you're dealing with immediately.

Start in the event list

Open your workspace and go to Events. If the event appears in the list, ingest is working and the problem is between Watchtower and your destination endpoint. If the event doesn't appear at all, the problem is upstream: between your provider and Watchtower.

Event arrived, delivery failing

Click the event to open the detail view. You'll see:

• The full request body and headers as received
• The verification stamp (Verified / Failed / Skipped)
• Each delivery attempt with its HTTP status and response body

Non-2xx status from your endpoint: your server received the request but returned an error. Check the response body in the attempt log for details. Common causes: an unhandled exception in your webhook handler, a middleware layer rejecting the request (auth, CSRF), or a validation error.

Timeout (no response within 10s): your endpoint accepted the connection but didn't respond in time. Make sure your handler returns 200 immediately and processes the payload asynchronously. Even simple synchronous handlers can hit 10 seconds under load.

Connection refused or DNS failure: the destination URL isn't reachable. Check that the URL is correct and that your server is running. For local dev tunnels, make sure the tunnel is active.

Verification stamp is Failed: the event arrived but the signature didn't match your configured secret. See Signature Verification for how to debug this.

Event not appearing in the dashboard

If there's no event in the list, the issue is upstream. Check your provider's delivery log first.

Stripe: Developers → Webhooks → your endpoint → recent deliveries. Stripe shows the response code and body your server returned. If Stripe shows a 2xx, the event arrived, so check that the ingest URL you configured in Stripe matches the one shown in your source settings exactly.

GitHub: Repository or organisation settings → Webhooks → your endpoint → Recent Deliveries. Each delivery shows the full request and response.

Shopify: Settings → Notifications → Webhooks. Shopify shows recent delivery status.

If your provider shows a non-2xx from the ingest URL, the URL may be wrong, or a network layer is blocking the request before it reaches the ingest server.

Signature mismatches

A Failed verification stamp almost always means one of these:

1. The secret in your source settings doesn't match the one in your provider's dashboard. Re-paste the secret from your provider to rule out whitespace or character issues.
2. A proxy or load balancer is modifying the request body before it reaches the ingest URL. HMAC verification requires the exact raw bytes. Any transformation breaks it.
3. You're using the wrong provider preset. If you're connecting a Stripe source using the Custom preset, switch to the Stripe preset, which handles the timestamp-prefixed format.

Useful things to check in the event detail

• Source IP: confirms the request came from your provider's known IP range
• Headers: shows the exact signature header as received, useful for comparing against what your provider says it sent
• Raw body: the exact bytes received, before any parsing
• Attempt history: every retry, with timestamps, HTTP status codes, and response bodies

Still stuck?

Email hello@webhookwatchtower.co.uk with the event ID from the dashboard and a description of what you're seeing. Include the provider, the error, and what you've already checked.