FAQ

What is the payload size limit?

512KB per event. Larger payloads are rejected with a 413 status and nothing is stored. Real platform webhooks sit far below this limit.

Is there a rate limit?

60 requests per minute per endpoint. Beyond that, deliveries receive a 429 status with a Retry-After header until the minute window passes.

How long are events kept?

24 hours on the Free plan and 90 days on Pro. A daily cleanup job deletes events past the window permanently; there are no backups of expired events.

Is my data private?

Webhook payloads and headers are stored on Cloudflare infrastructure only for your retention window. There are no analytics or tracking scripts on this site or in the dashboard. Deleting your account from the settings page removes your endpoints and all stored events immediately. The privacy policy has the full detail.

What happens if my endpoint receives something that is not JSON?

It is stored anyway, exactly as sent, and the inspector shows it raw with a clear badge. Capturing what actually arrived is the point.

Can I receive webhooks on the app domain?

The canonical webhook host is hooks.commercehook.app, and that is what the dashboard hands out. Deliveries to the same path on app.commercehook.app are forwarded to the same place, so either works.