A free webhook.site alternative: request bins without the 100-request cap

You need a URL that accepts whatever some service throws at it — a webhook delivery, a form post, an SDK you don't control — and shows you exactly what arrived: method, path, headers, signature, body. webhook.site made this workflow famous, but its free URLs stop working after 100 requests and expire after 7 days. Mockbird gives you the same workflow with 10,000 requests/day per project, URLs that don't expire, and control over the response — free, no signup.

Try it in 10 seconds (no setup)

The shared demo project has a catch-all route and a public request inspector. Send it anything:

curl -X POST https://HOST/m/demo/my/test/hook \
  -H 'content-type: application/json' \
  -H 'X-Signature: sha256=whatever' \
  -d '{"event":"ping","n":1}'

# now read the bin — your request is in there, headers and all
curl https://HOST/api/projects/demo/requests

(The demo is shared and resets daily — make your own private bin below.)

Make your own bin: one project, one route

# 1. create a project (no signup needed)
curl -X POST https://HOST/api/projects \
  -H 'content-type: application/json' -d '{"name":"my-bin"}'
# → {"id":"abc123","adminKey":"KEY", ...}

# 2. add a catch-all route: any method, any path
curl -X POST https://HOST/api/projects/abc123/routes \
  -H 'X-Admin-Key: KEY' -H 'content-type: application/json' \
  -d '{"method":"ANY","path":"/*","body":{"ok":true}}'

That's it. Point any sender at https://HOST/m/abc123/anything — every path under your project answers 200 {"ok":true} and gets logged. Read deliveries from the API or watch them stream into the dashboard (Recent requests card, tick “live”, click a row to expand headers and body):

curl https://HOST/api/projects/abc123/requests -H 'X-Admin-Key: KEY'

Each entry has the method, path, query string, response status, Origin, the request body, and captured headers: content-type, user-agent, accept, referer, and every x-* header — so X-Hub-Signature-256, X-Stripe-Signature-style custom headers and delivery ids are right there. (Authorization is logged with its value redacted.)

Reply like the real thing

A bin that can only say 200 OK fails half the handshakes out there. Mockbird routes are templated, so the response can echo the request. The classic: a URL-verification handshake that must echo a challenge from the body —

curl -X POST https://HOST/api/projects/abc123/routes \
  -H 'X-Admin-Key: KEY' -H 'content-type: application/json' \
  -d '{"method":"POST","path":"/slack",
       "body":"{\"challenge\":\"{{body.challenge}}\"}"}'

Exact routes beat the catch-all, so /slack does the handshake while /* keeps catching everything else. Any status (201, 410, whatever the sender expects), custom response headers, text/plain or XML bodies, and artificial latency (delayMs) all work per route.

Scoped bins & bins that coexist with your mock API

Catch-alls are a fallback: your seeded resources and specific routes always win. So one project can be your full mock backend (/products, /orders…) and quietly log every stray request your app makes to a path you didn't mock — instant answer to “what is my frontend actually calling?”. Prefer a subtree? {"path":"/webhooks/*"} only catches under /webhooks/, and the rest of the path is available to templates as {{params.splat}}.

Honest comparison

Tool	Free capacity	URL lifetime	Headers shown	Custom response
webhook.site	100 requests total	7 days (free)	yes	one static default; scripting is paid
Beeceptor	50 requests/day	unclaimed endpoints deleted after 7 days (90 claimed)	yes	rules engine, limited free
ngrok + local server	your machine	while the tunnel runs	yes	anything — you write the code
Mockbird	10,000 requests/day/project	no expiry	yes — curated + all `x-*`	per-route status/body/headers, templated, free

Where the others still win: webhook.site can forward/replay requests to a real upstream and offers email and DNS bins; Beeceptor can proxy to your real API; ngrok exposes your actual code. Mockbird's bin doesn't proxy — it logs and replies. Also honest: the inspector keeps the last 50 requests per project and truncates stored bodies at ~2,000 characters, so it's a debugging window, not an archive. Written by the Mockbird maker — bias disclosed, numbers checked July 2026.

When the webhook is the thing you're building

Flip it around: if you need incoming test events to develop a webhook consumer, Mockbird also fires signed outbound webhooks on every record change in a project — HMAC-SHA256 signature header included, so you can build and verify your consumer end-to-end. Guide: send test webhooks.

Full route reference in the docs. The same free project also does seeded CRUD, GraphQL, mock JWT auth, and snapshot fixtures. Create a bin →