Webhook Contract Writer is a free prompt. Paste a sample webhook body. Get required fields, the idempotency key, retry behavior, and how you will verify the signature.
It is not always the right tool. Here is when something else wins, and when it does not.
By hand
The provider's webhook docs
Pick it if
The provider is Stripe or GitHub and the docs are thorough.
Pick Webhook Contract Writer if
All you have is one sample body and a ticket, and you need the contract written down before coding.
Dedicated tool
Svix or Hookdeck
Pick it if
You are sending or receiving webhooks at volume and want retries handled for you.
Pick Webhook Contract Writer if
You need to understand and document one integration first.
0:00The habitA form webhook creates a billing post and a sheet row. Amounts under 1 EUR are tests. Email stays out of the channel.
0:08The recipeTrigger: webhook. Filter: amount >= 1. Actions: sheet append with email, channel post without email. Failure: one FAILED message, stop after two tries.
0:16The testA 0.50 payload stops at the filter. A 40 EUR payload reaches both actions and the channel text has the order id, not the email.
0:24The slotThe sheet credential is named as a slot. The recipe does not contain a key.
No daily video for this drop yet. The in and out lines above are the preview.
0:00The diff that 'works'A Next.js DELETE handler reads an id from JSON, concatenates it into SQL, and returns a live-looking secret key in the response.
0:08What it should catchA secret in source. SQL built with string concatenation. No check that this caller owns the note. The key echoed back to the client.
0:16Severity, then the fixHigh: move the key to an environment variable and rotate it. High: parameterize the query. High: derive the user from the session and filter the delete by owner.
0:24What it will not doIt will not hand you a working exploit. The sample key is fake. The output is the safer handler, not a payload.
No daily video for this drop yet. The in and out lines above are the preview.
0:00The callPOST /api/refunds returned 401 bad signature twice. The body says the prefix should be sha256=. They may have signed with the example placeholder.
0:08What brokeThe server rejected the signature. The status is not a transient outage. The prefix note is a hint about the header format.
0:16The changeSign the raw body with the real secret, prefix the header with sha256=, and keep the same idempotency key so a later success does not double-apply.
0:24RetryDo not retry the same bytes. Retry once after the header changes. Forging a signature for someone else's API is out of scope.
No daily video for this drop yet. The in and out lines above are the preview.
0:00The driftPORT and DATABASE_URL are read. DATABASE_URL is required. FLY_REGION is read and missing from the example.
0:08UnusedNothing in the example is unread. FLY_REGION is the gap, the other way.
0:16The live-looking valueSTRIPE_SECRET_KEY's example starts with sk_live_. That prefix does not belong in an example even if they say it is fake.
0:24The fixAdd FLY_REGION=local. Change the Stripe example to a sk_test_ placeholder. Do not print a real key.
No daily video for this drop yet. The in and out lines above are the preview.
Questions
What are the alternatives to Webhook Contract Writer?
The provider's webhook docs (by hand); Svix or Hookdeck (dedicated tool). On One Agent a Day, Automation Recipe Writer, Vibe-code Security Checker, API Error Explainer, Env Var Auditor do a similar job.
When is the provider's webhook docs better than Webhook Contract Writer?
The provider's webhook docs is the better pick when the provider is Stripe or GitHub and the docs are thorough. Webhook Contract Writer is the better pick when all you have is one sample body and a ticket, and you need the contract written down before coding.
When is Svix or Hookdeck better than Webhook Contract Writer?
Svix or Hookdeck is the better pick when you are sending or receiving webhooks at volume and want retries handled for you. Webhook Contract Writer is the better pick when you need to understand and document one integration first.
Tomorrow's drop
Get tomorrow's agent in your inbox
One email when the drop goes up. No digest, no course. Unsubscribe from the beehiiv email whenever you want.
Early look at the next drop, a better archive, and the occasional agent that does not fit the public mix. The daily agent stays free. A custom build is €49–199. Nothing is charged from this form.