Hookbase for VS Code: Debug Webhooks Without Leaving the Editor

The Webhook Loop, in One Window

Debugging a webhook usually takes three windows: the provider's dashboard to trigger the event, a terminal running a tunnel, and the Hookbase dashboard to see what was delivered. Then you go back to the editor, change the handler, and go round again.

Today Hookbase for VS Code 1.0 is on the Visual Studio Marketplace and Open VSX. It puts that loop in the editor. Catch webhooks on a stable public URL, forward them to localhost, watch every delivery as it happens, and replay the one that failed (edited, if you like) until your handler gets it right.

Install

Search for Hookbase in the Extensions view, or run:

code --install-extension HookbaseApp.hookbase

It needs VS Code 1.101 or later. Cursor, VSCodium and other compatible editors install it from Open VSX. It runs on the desktop only: the tunnel needs a real socket to localhost, which vscode.dev and github.dev can't open.

Try It Without an Account

Open the Hookbase sidebar and click Create Request Bin. You get a public URL that records every request sent to it for 24 hours, and you don't need to sign up. Point a Stripe, GitHub or Shopify webhook at it, or paste the sample curl into a terminal, and each request appears in the view. From there you can:

• open it to see the exact method, path, headers and body;
• replay it to your local server as many times as you need;
• set the status the bin answers with, to watch the provider retry.

It's the same request bin as the free webhook tester on this site. To walk through the rest (sign in, create a source, start a tunnel, send a test event), run Welcome: Open Walkthrough… and pick Get Started with Hookbase.

A Tunnel URL That Doesn't Change

Hookbase: Start Tunnel forwards a public URL to a port on your machine. Each workspace keeps its own tunnel, and stopping it only disconnects. The next start reconnects to the same address, so the webhook URL you pasted into the provider's settings still works tomorrow. If the tunnel is live in another window, the extension asks before taking it over.

• Tunnel Requests shows every forwarded request with full headers and bodies, plus Copy as cURL and Replay to localhost. Both always target localhost on your tunnel port, whatever path a caller sent.
• Configure Tunnel Filter forwards only the sources, event types or payloads you care about.
• Manage Tunnels lists your tunnels, reassigns or deletes them, and creates one with a custom subdomain.
• You get a notification when your server returns a 5xx or can't be reached.

Ctrl+Alt+H, then T, starts the tunnel, or stops it while one runs. These are the same tunnels the CLI opens with hookbase tunnel, and Tunnels explains how they work.

When a Delivery Fails

Live Activity streams webhooks as they arrive and deliveries as they finish, starting with the recent history. Click a row to open the delivery panel. Its Request, Response and Timeline tabs show what Hookbase sent, what came back, and where the time went. Credentials in the Raw tab are masked.

From there:

• Analyze Failure gives the likely cause, the evidence for it, and a suggested fix.
• Replay with Changes… opens the received payload in an editor. Edit it, then send it through the route again, optionally to a different destination. On a source that masks or encrypts fields, only the fields you changed are sent, so the rest keep their real values. Replay with edit covers how that works.
• Diff Payload compares what arrived with what was delivered, in VS Code's own diff view. Export HAR writes the exchange to a file that Chrome DevTools, Charles and Proxyman can open.
• Failure Clusters groups failures by cause, so 400 identical errors are one row, and you can replay a whole cluster at once. See how clusters are fingerprinted.
• Dead Letter Queue lists deliveries that won't be retried again. Select any number and retry or discard them together.
• Filter Deliveries and Filter Events narrow the views. For example, status:failed source:stripe payload.data.object.id:"ch_123" works in one box.
• Routes show their circuit-breaker state, and Reset Circuit closes a tripped one.

Ask @hookbase in Copilot Chat

With GitHub Copilot Chat installed, @hookbase answers in the chat panel:

• @hookbase /why <delivery id>: why it failed, and what to change
• @hookbase /tail: the last ten deliveries
• @hookbase /replay <delivery id>: re-send it, after you confirm
• @hookbase /setup <provider>: set up a new source, step by step

In agent mode, Copilot can also use four Hookbase tools on its own: list recent deliveries, read a payload, explain a failure, and replay (it asks you first). When a delivery id turns up in a log, an output channel or a pasted terminal line, the lightbulb offers Explain This Failure.

The extension also registers the hosted Hookbase MCP server, so it appears under MCP: List Servers with nothing to configure. Copilot is needed only for @hookbase and the language model tools. Everything else works without it.

Build the Pipeline From the Editor

• New Source, New Destination and New Route are wizards. The required fields come first, then one list of optional settings: signing secrets, rate limits, IP filtering, deduplication, auth, headers, timeouts, filters, transforms, schemas, failover and notifications. Edit… changes one setting at a time.
• New Source follows the provider catalog. It asks for the signing secret only when the provider issues it, and shows a Hookbase-generated secret once, with a copy button.
• Send Test Event sends an event through the real ingest path, signed with the source's own secret. The payload can come from the provider's catalog, a template, a past event, an open editor or a file. It asks you to confirm first, because it creates a real event.
• Transforms are files under .hookbase/transforms/. Test Transform runs one against a payload and shows engine errors as squiggles on the offending token. Test Filter and Validate Against Schema do the same for filters and schemas.
• Compute Signature and Verify Signature sign or check the active editor's bytes with any provider's scheme. When a check fails, the usual cause is a re-serialized body rather than a wrong secret; debugging invalid signature errors goes through the rest.
• Mock Destination Response makes a destination answer 500, 429 or a slow 200, so you can watch retries and the circuit breaker without breaking anything real.

Outbound Webhooks Too

If you use Hookbase to send webhooks to your own customers, run Configure Views and turn on Outbound Applications, Outbound Messages and Event Types. Endpoints have Send Test Event, Reset Circuit, Replay Failed Messages and Rotate Signing Secret, and failed messages can be replayed. Send Outbound Event from Editor sends the open JSON file to every subscriber, or to a single application. Live Activity shows outbound messages and their attempts next to inbound deliveries, marked with an envelope icon.

Signing In and Privacy

Hookbase: Sign In opens your browser and confirms a short code, so there's no key to copy. If you belong to several organizations, click the status bar item and choose Switch Organization. For CI or a self-hosted install, Sign In with API Key takes a whr_… key. Both kinds of credential are kept in VS Code's Secret Storage.

The extension sends no telemetry. It talks only to the Hookbase API you point it at (hookbase.apiBaseUrl).

Get Started

Install it from the Marketplace or Open VSX, open the Hookbase view, and create a request bin. When you want sources, routes and a tunnel of your own, sign in: the free plan includes 1,000 events a month, five sources and a tunnel.