Debugging Webhooks with Ngrok’s Request Inspection UI

Problem: You need to see what your webhook receiver actually got

When integrating a third‑party service, the payload that arrives at your local endpoint can differ from what you sent during testing. Without visibility, you rely on logs that may be missing or incomplete.

Thesis: Ngrok’s built‑in request inspection UI lets you view, filter, and replay every HTTP/HTTPS request that passes through a tunnel, giving you instant feedback without adding logging code.

How to enable inspection

Start ngrok with a valid authtoken and expose your local server:

# Run in a terminal with permission to execute ngrok
ngrok http 8080

While the tunnel is active, open http://localhost:4040 in a browser to see the inspection dashboard.

Worked example: debugging a Slack webhook

1. Leave the ngrok command running from the previous step.
2. Configure your Slack app to point its event subscription URL to the public ngrok HTTPS URL (shown in the terminal, e.g., https://abcd1234.ngrok.io).
3. Trigger an event in Slack (e.g., send a message to a channel that triggers the event).
4. Return to http://localhost:4040. The latest request appears in the list with method, URL, status, and response time.
5. Click the request to view the full JSON body Slack sent, and the response your server returned.
6. If you need to test again, press the Replay button; ngrok resends the exact same request to your local server, and the UI updates with the new response.

Trade‑off and limitation

• Inspection data lives only in memory; stopping the ngrok process clears the history. If you need a persistent record, start ngrok with --inspect-db=path/to/file.db to write to a local file.
• The UI displays request and response bodies in plain text. Anyone with access to your machine’s browser can see sensitive fields such as authorization tokens or passwords. Limit access to the inspection UI or disable inspection for production‑grade tunnels.
• Inspection works for HTTP and HTTPS tunnels only; TCP tunnels do not provide request‑level visibility.

Actionable closing

Next time you need to verify a webhook payload, spin up an ngrok tunnel, point the provider at the public URL, and use the inspection UI to inspect and replay requests. Enable the persistent inspection file only when you need to retain history across restarts, and always restrict local browser access to avoid leaking credentials.