FAQ

What is the payload size limit?

512KB per event. Larger payloads are rejected with a 413 status and nothing is stored. Real platform webhooks sit far below this limit.

Is there a rate limit?

60 requests per minute per endpoint. Beyond that, deliveries receive a 429 status with a Retry-After header until the minute window passes.

How long are events kept?

24 hours on the Free plan and 90 days on Pro. Events past the window are deleted permanently, usually within the hour; there are no backups of expired events.

Is my data private?

Webhook payloads and headers are stored on Cloudflare infrastructure only for your retention window. A header that carries a credential (Authorization, Cookie, Proxy-Authorization) is stored with its value replaced by [redacted], and the headers Cloudflare adds in transit, the sender’s IP address among them, are not stored at all. This site counts page views without cookies and without any profile of you; the dashboard is not measured at all. Deleting your account from the settings page removes your endpoints and all stored events immediately. The privacy policy has the full detail.

What happens if my endpoint receives something that is not JSON?

It is stored anyway, exactly as sent, and the inspector shows it raw with a clear badge. Capturing what actually arrived is the point.

Can I receive webhooks on the app domain?

The canonical webhook host is hooks.commercehook.app, and that is what the dashboard hands out. Deliveries to the same path on app.commercehook.app are forwarded to the same place, so either works.