Finxture — payment webhook testing on localhost

Signed, deterministic Stripe events for your dev server: your amounts, ordered timeline, duplicate delivery, replay. No ngrok.

Finxture is a free Chrome extension for testing Stripe webhooks on localhost. It sends realistic, signed Stripe test webhook events to the http://localhost or http://127.0.0.1 endpoint you configure, so you can build and debug your webhook handler without ngrok, an inbound tunnel, an account, or a cloud connection. WHY The happy path is the easy part. The cases that break payment integrations in production are the ones that are hardest to reproduce on your own machine: the same event delivered twice, a delivery you have to replay after your server returned a non-2xx, events that have to be processed in order. Finxture reproduces them on demand, deterministically, against the server you already have running. WHAT IT DOES - Run a webhook scenario from a reviewed catalog against your own local server, and get the same event sequence every time. - Configure the payment a run delivers — amount, currency, merchant reference, and your own metadata — instead of only the catalog's fixed defaults. Currency is checked against a curated list of real ISO 4217 codes, not any three letters, and metadata that looks like card numbers, secrets, or personal data is rejected before the run starts. - Verify your signature checking: every event is signed with a locally generated, test-only Stripe webhook signing secret, computed the same way your production verifier expects (Stripe's v1 HMAC scheme). - Follow a durable run timeline of every event and every delivery attempt. It survives Chrome closing the extension's background worker mid-run: in-flight deliveries resume, and you can replay a failed delivery attempt after your server returns a non-2xx response. - Read a per-run report card — "Your application should…" — listing automatic checks (verified from the delivery outcomes) and manual checks (for behavior Finxture can't observe directly, like idempotent state updates), so you can see at a glance whether your webhook handler did the right thing. - Export a run as JSON: a full export for your own debugging (includes the signing secret — not for sharing), or a redacted export with credentials, signatures, and response bodies stripped, safe to attach to a bug report. SCENARIOS IN THIS RELEASE - Payment succeeds — an authorization-success event followed by a payment-success event, in order, exactly once. - Duplicate payment webhook — reuses the successful-payment flow and delivers the same logical payment-success event twice with independently valid signatures, so you can verify your handler processes duplicate webhook deliveries idempotently (a real Stripe behavior, since Stripe's own docs describe at-least-once delivery). Coming soon (not yet runnable in this release): Declined payment, Requires customer action. WHAT THIS IS NOT This is a local development sandbox, not a Stripe emulator or a certified Stripe integration. It does not claim complete Stripe API or webhook coverage, does not talk to Stripe's servers, does not process real payments, generates no real cardholder data, and is not intended for production traffic, live credentials, or production endpoints. "Stripe" is used here only to describe the webhook shapes Finxture reproduces for local testing — Finxture is not made, certified, or endorsed by Stripe. PRIVACY Your endpoint configuration, signing secret, and run history stay in Chrome's local extension storage on your device and are never uploaded. The only optional exception is consent-based product telemetry: after an explicit, itemized first-run consent screen (on by default, changeable anytime in settings), Finxture may send up to four coarse usage counters (install, endpoint configured, first successful run, run completed) to our EU-hosted analytics processor — never webhook bodies, secrets, endpoint URLs, or response content. Full details: https://finxture.dev/privacy Requires only two Chrome permissions (storage, side panel) plus optional, runtime-granted access to the one loopback host (localhost or 127.0.0.1) you choose. No `host_permissions` for arbitrary websites, no content scripts.