Give Stripe a temporary public HTTPS endpoint that forwards to a webhook handler on your laptop. This is useful when you need a real externally reachable callback URL, while the Stripe CLI remains the better default for generating Stripe test events locally.
First choose the right testing path
For ordinary Stripe integration development, start with Stripe's official CLI. It creates test events, forwards them directly to localhost, and prints the matching webhook signing secret:
stripe listen --forward-to http://localhost:4242/webhook
stripe trigger payment_intent.succeededUse Serveo when another system must call the endpoint over the public Internet, when you want to exercise a dashboard-registered webhook URL, or when several providers need to reach the same local application.
Expose the local webhook handler
With your application listening on port 4242, start:
ssh -R 80:localhost:4242 serveo.netServeo prints a URL such as https://your-host.serveousercontent.com. Register https://your-host.serveousercontent.com/webhook as the Stripe endpoint and select only the events your handler needs.
A random hostname is appropriate for a short manual test, but it can change whenever the tunnel reconnects. A dashboard endpoint used repeatedly needs a reserved hostname, or you must update the Stripe endpoint after each tunnel session.
Verify signatures using the raw request body
Read the Stripe-Signature header and pass the unmodified request body to the Stripe SDK. JSON parsing, whitespace changes, or character re-encoding before verification can invalidate the signature. A Stripe CLI listener and a dashboard-registered endpoint normally use different signing secrets, so use the secret belonging to the path currently sending the event. Follow Stripe's official signature-verification guide.
Serveo's free browser warning targets requests that explicitly accept HTML. Normal webhook POST requests pass directly to the tunnel, so the interstitial does not replace Stripe's delivery payload.
Test safely
- Use Stripe test mode and test API keys until the handler is ready.
- Return a successful response quickly, then process longer work asynchronously.
- Make event handling idempotent because providers retry failed deliveries.
- Never put API keys or webhook secrets in the public URL.
- Stop the tunnel and remove temporary dashboard endpoints after the test.
Stripe's current end-to-end workflow is documented in its official webhook guide. Serveo supplies the public transport; Stripe's SDK and signing secret establish authenticity.