LIVE2025

Secure Webhook Proxy & Relay Gateway

Integrating payment channels (Stripe) or messaging networks (Meta, WhatsApp) requires receiving live event notifications during development and testing. The naive approach — exposing a local port via ngrok or SSH tunnel — creates a direct public internet path into the developer's machine and introduces a live credential security risk. I built a centralized, secure webhook proxy server that eliminates this exposure entirely. The relay server receives all inbound webhook calls at a stable public HTTPS endpoint, handles vendor-specific verification handshakes (HMAC signature validation for Stripe, challenge-response for Meta), persists every payload to a database audit log, and forwards the event to the registered local target. Developers replay any logged event with a single click — eliminating the "trigger the event again" cycle that burns hours during integration debugging.

Launch Application GitHub →

$ Architecture

→Express relay server: single public HTTPS endpoint receives all inbound webhook calls. Route-level handler resolves the target registration from MongoDB, validates the vendor HMAC signature or challenge-response, and forwards the payload to the registered local URL via Axios.
→Vendor verification layer: Stripe webhooks validated via stripe-signature header (timing-safe HMAC comparison). Meta/WhatsApp hub.verify challenge-response handled at the GET endpoint before any POST payload is accepted.
→MongoDB payload store: every inbound request persisted with timestamp, source vendor, HTTP headers, raw body, forwarding target, response status, and latency. Enables full audit trail and replay without re-triggering the external vendor.
→One-click replay API: POST /replay/:eventId re-sends the stored raw payload to the registered target — eliminates the manual "go back to Stripe dashboard and trigger again" cycle during debugging.
→React dashboard (Vite + Tailwind): live event log with filter by vendor, status, and date. Per-event detail view showing raw headers, body, and forwarding response. Replay button inline.
→JWT-authenticated admin API — all relay registrations and event log access require a valid token. Nginx reverse proxy terminates TLS.

$ Tech Stack

Node.jsExpressReactViteTailwind CSSMongoDBJWTDockerNginx

$ Outcomes

→100% secure API testing: zero local network vulnerability — local dev environment never exposed to the public internet

→Vendor HMAC signature validation (Stripe) and challenge-response handling (Meta/WhatsApp) — relay server speaks each vendor's verification protocol natively

→Durable audit log: every inbound payload stored with headers, body, forwarding status, and latency — full debugging trail across sessions

→One-click event replay: re-send any historical payload to the target with a single API call — eliminates the "trigger the webhook again" debugging cycle

→Integration development cycle speed increased 2× — replay replaces the multi-step manual re-trigger flow

→React dashboard with live event log: filter by vendor, status, and date; inspect raw headers and body per event

→Multi-vendor architecture: designed to add new webhook sources (GitHub, Shopify, Twilio) without changes to the relay core