Webhook

Testing & Sample Code

Copy page

Testing and delivery logs

Sending a test event

You don't have to wait for a real message or status change to confirm your endpoint works. From the webhook list, click the flask icon (Test) on any webhook row:

1. Pick one of the webhook's subscribed event types.
2. Click Send Test.

Chatmo builds a realistic sample payload for that event and sends it to your endpoint immediately, using the same signing and delivery path a real event would go through. The result (success or failure, with the error if any) shows right in the modal, and the attempt is logged like any other delivery — marked with a Test badge so it's easy to tell apart from real traffic.

:::tip Test every event type you subscribed to Sample payloads use placeholder data, but they exercise your endpoint's real parsing and signature verification path — a good way to catch a broken handler before it matters. :::

Reading the delivery log

Click View Logs on a webhook row to see every delivery attempt-group for that endpoint.

The list shows, per delivery:

Column	Description
Triggered At	When the event happened
Event Type	Which event fired
Channel	The channel the event came from
Status	SUCCESS, FAILED, or PENDING
HTTP	The HTTP status code your endpoint returned (blank if it never responded)
Response Time	How long your endpoint took to respond
Retries	How many attempts this delivery took

All filtering — date range, delivery status, HTTP status code, event type, and search — runs server-side, so it stays fast even with a large history.

Viewing one delivery in detail

Click View Log on any row to open the full detail: the exact request payload and headers Chatmo sent, and the exact response status, headers, and body your endpoint returned.

Resending a delivery

From the detail view, click Resend to re-sign and re-send that same event to the endpoint right now. This is useful after fixing a bug on your end — rather than waiting for the next real event, you can replay the one that failed. A resend always creates a new log entry; the original stays in the log as-is for audit purposes.

Sample code

These samples verify the X-Chatmo-Signature header described in Authentication & Security. Each one computes an HMAC-SHA256 of the raw request body using your webhook's signing secret and compares it against the header, in constant time.

Replace YOUR_SIGNING_SECRET with the secret shown when you created the webhook.

cURL — simulate a delivery locally

Useful for testing your handler without waiting for a real event or using the dashboard's Test button:

Code
SECRET="YOUR_SIGNING_SECRET"
BODY='{"event":"message.received","created_at":"2026-09-16T10:00:00Z","data":{"message_id":"test-1"}}'
SIGNATURE="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')"

curl -X POST https://your-server.com/webhooks/chatmo \
  -H "Content-Type: application/json" \
  -H "X-Chatmo-Event: message.received" \
  -H "X-Chatmo-Signature: $SIGNATURE" \
  -d "$BODY"

Node.js

Code
const crypto = require('crypto');
const express = require('express');
const app = express();

const SIGNING_SECRET = process.env.CHATMO_WEBHOOK_SECRET;

function isValidSignature(rawBody, signatureHeader) {
  if (!signatureHeader || !signatureHeader.startsWith('sha256=')) return false;
  const expected = crypto
    .createHmac('sha256', SIGNING_SECRET)
    .update(rawBody)
    .digest('hex');
  const provided = signatureHeader.slice('sha256='.length);
  const expectedBuf = Buffer.from(expected, 'hex');
  const providedBuf = Buffer.from(provided, 'hex');
  return (
    expectedBuf.length === providedBuf.length &&
    crypto.timingSafeEqual(expectedBuf, providedBuf)
  );
}

// express.raw() keeps req.body as a Buffer — required for signature verification.
app.post('/webhooks/chatmo', express.raw({ type: 'application/json' }), (req, res) => {
  if (!isValidSignature(req.body, req.header('X-Chatmo-Signature'))) {
    return res.status(401).send('invalid signature');
  }
  const event = JSON.parse(req.body);
  res.status(200).send('ok');
  // process `event` asynchronously here
});

Python

Code
import hashlib
import hmac
import os
from flask import Flask, request, abort

app = Flask(__name__)
SIGNING_SECRET = os.environ["CHATMO_WEBHOOK_SECRET"]

def is_valid_signature(raw_body: bytes, signature_header: str | None) -> bool:
    if not signature_header or not signature_header.startswith("sha256="):
        return False
    expected = hmac.new(SIGNING_SECRET.encode(), raw_body, hashlib.sha256).hexdigest()
    provided = signature_header.removeprefix("sha256=")
    return hmac.compare_digest(expected, provided)

@app.post("/webhooks/chatmo")
def chatmo_webhook():
    raw_body = request.get_data()  # raw bytes, not request.json
    if not is_valid_signature(raw_body, request.headers.get("X-Chatmo-Signature")):
        abort(401)

    event = request.get_json()
    # process `event` asynchronously here
    return "ok", 200

PHP

Code
<?php

$signingSecret = getenv('CHATMO_WEBHOOK_SECRET');

function isValidSignature(string $rawBody, ?string $signatureHeader, string $secret): bool
{
    if ($signatureHeader === null || !str_starts_with($signatureHeader, 'sha256=')) {
        return false;
    }
    $expected = hash_hmac('sha256', $rawBody, $secret);
    $provided = substr($signatureHeader, strlen('sha256='));
    return hash_equals($expected, $provided);
}

$rawBody = file_get_contents('php://input'); // raw bytes, not $_POST
$signatureHeader = $_SERVER['HTTP_X_CHATMO_SIGNATURE'] ?? null;

if (!isValidSignature($rawBody, $signatureHeader, $signingSecret)) {
    http_response_code(401);
    exit('invalid signature');
}

$event = json_decode($rawBody, true);
http_response_code(200);
echo 'ok';
// process $event asynchronously here

Go

Code
package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"net/http"
	"os"
	"strings"
)

var signingSecret = os.Getenv("CHATMO_WEBHOOK_SECRET")

func isValidSignature(rawBody []byte, signatureHeader string) bool {
	const prefix = "sha256="
	if !strings.HasPrefix(signatureHeader, prefix) {
		return false
	}
	mac := hmac.New(sha256.New, []byte(signingSecret))
	mac.Write(rawBody)
	expected := hex.EncodeToString(mac.Sum(nil))
	provided := strings.TrimPrefix(signatureHeader, prefix)
	return hmac.Equal([]byte(expected), []byte(provided))
}

func chatmoWebhookHandler(w http.ResponseWriter, r *http.Request) {
	rawBody, err := io.ReadAll(r.Body)
	if err != nil {
		http.Error(w, "failed to read body", http.StatusBadRequest)
		return
	}

	if !isValidSignature(rawBody, r.Header.Get("X-Chatmo-Signature")) {
		http.Error(w, "invalid signature", http.StatusUnauthorized)
		return
	}

	var event map[string]any
	if err := json.Unmarshal(rawBody, &event); err != nil {
		http.Error(w, "invalid json", http.StatusBadRequest)
		return
	}

	w.WriteHeader(http.StatusOK)
	// process `event` asynchronously here
}