Test Message webhooks locally
Use an HTTPS tunnel and a test endpoint to verify delivery, signatures and retries without changing production callbacks.
Reviewed against the implementation · 2026-10-30
Start a receiver and HTTPS tunnel
Run your development receiver on a local port, then use your tunnel provider’s supported command, such as ngrok http 3000. Use the HTTPS forwarding URL it returns. Keep this receiver separate from your production webhook destination.
Preserve the raw request body
Verify the X-Message-Signature header against the exact received bytes before parsing JSON or processing an event. Use the signature example linked below. Do not log API credentials, signing secrets or complete customer payloads; a delivery ID, event type and result are enough for most diagnostics.
Register a supported outgoing event
For Verify, use the service’s webhook endpoint configuration and its test-delivery action. Subscribe only to topics supported by that product. Provider email and carrier callbacks arriving at Message.com are a different integration: do not replace those production URLs with your local tunnel.
Check the result
Trigger a permitted test event. Confirm a valid signature, the expected topic and a successful delivery result in the delivery log. Return a successful response only after you have durably accepted the event. Reject invalid signatures and deduplicate already accepted event IDs.
Exercise retries
Temporarily return an error from your test receiver, then restore it and inspect the documented retries. Events can arrive more than once and out of order. Stop the tunnel and remove the temporary endpoint when finished so private events are not routed to an abandoned development URL.