Guides

Webhook capture without a tunnel: testing customer integrations during a sales call

Why ngrok and Cloudflared are not the answer for live demos, and how a hosted webhook receiver changes how solutions engineers run calls.

·6 min read

You are on a sales call. The prospect wants to see a webhook arrive in real time after they take an action — that is how they trust your integration. You have ten options and most of them are bad.

The traditional answer is a tunnel

ngrok, cloudflared, localtunnel. The solutions engineer starts a tunnel locally, points the third-party webhook at it, and prays the tunnel does not drop mid-call. Three things fail here on every call:

  • ·Tunnels expire. The free tier on ngrok times out after two hours. Your call is at hour 1:45.
  • ·Corporate networks block them. The prospect’s VPN does not let the tunnel domain through DNS.
  • ·The receiver code is on someone’s laptop. When that laptop sleeps, your demo dies.
  • ·Nobody owns the receiver code, so it accumulates one-off prints that look unprofessional.

What a hosted receiver gives you

A hosted webhook receiver is a URL that does three things: takes a POST, stores it, and renders it in a feed you can show on the call. apiqube hands you one per project, gated by a token so only the integration that knows the URL can post.

POST https://www.apiqube.com/hooks/<projectId>/<token>
Content-Type: application/json

{ "event": "payment.succeeded", "amount": 1999 }

→ stored, timestamped, visible in your demo feed

There is no tunnel. There is no laptop. The URL exists for as long as the project exists. The SE on the call does not need to install anything. The prospect sees a live event log update on screen.

Replay matters more than capture

Capturing a webhook once is interesting. Replaying it is what proves the integration end-to-end. The receiver stores the payload — your demo can pull it back, walk through fields, or feed it into a follow-up step in a guided flow. This is the moment in a call where the prospect stops squinting at the screen and asks how soon they can have an account.

Security note

Hosted webhook receivers expand your surface area. The token in the URL is the only thing standing between the public internet and event injection. Rotate it if it ever ends up in a screenshot. Apiqube exposes a one-click rotate in the project settings for exactly this reason.

← All posts