# How can an agent receive webhooks without running a server? If your project already runs a server, add a route for the webhook: it costs nothing more, it is private, and you control it. If you only need to know what happened, ask the sender's own API instead: some senders keep a list of recent events you can read. For a quick test, a public request bin works without an account, but anyone who knows its address can read what arrives. To keep webhooks private without running anything yourself, write a small receiver on a free cloud plan and keep them as long as you like, or use a hosted inbox: free gateway plans keep a few days, and AgentMart's Webhook inbox keeps each message 30 days ($1 per 30 days). ## Free ways Checked on 2026-10-14. Facts about other services come from their own pages; the sources are under each one. ### A route on the server you already run A handler in your app that stores each webhook's body and headers in your own database. - Free: No extra cost. - Account and card: Nothing new. - Without a server: No: it is your server. - Keeps: As long as you keep it. Only you can read it. - Mind: You check the sender's signature and handle retries yourself. ### Reading the sender's own list of events Instead of receiving a webhook, read recent events from the sender. Stripe lists events going back up to 30 days, read with your API key. GitHub keeps a webhook's deliveries for 3 days, which the repository's admins (for an organization's webhooks, its owners) can read and redeliver. - Free: Part of those services. - Account and card: An account with that sender. - Without a server: Stripe: yes, you poll. GitHub: the webhook still needs an address to send to. - Keeps: Stripe: 30 days. GitHub: 3 days. Read with your own account. - Mind: Only for senders that offer it, and you ask instead of being called. - Sources (read 2026-10-14): https://docs.stripe.com/api/events/list, https://docs.github.com/en/webhooks/testing-and-troubleshooting-webhooks/viewing-webhook-deliveries, https://docs.github.com/en/webhooks/testing-and-troubleshooting-webhooks/redelivering-webhooks ### webhook.site A hosted request bin: an address that captures any request, readable later through its API. - Free: At most 100 requests per address; the address and its data are removed after 7 days. - Account and card: No account. - Without a server: Yes. - Keeps: 7 days. On the free version, the data is readable by anyone who knows the address's ID. - Mind: Fine for tests; do not send real customer data to it. - Sources (read 2026-10-14): https://docs.webhook.site/, https://docs.webhook.site/api/about.html, https://docs.webhook.site/api/requests.html ### Hookdeck A webhook gateway. Its Console gives test addresses with no account; for private ones it points to its Event Gateway, which has a free Developer plan. - Free: Developer plan: 10,000 events a month, 3 days of retention. Console: shows the most recent 250 requests of an address. - Account and card: Console: no account. Developer plan: an account, no card. - Without a server: Yes for receiving. Passing events on to your code needs a destination address or its command line tool. - Keeps: Developer plan: 3 days. Console addresses are not private: anyone with the ID can read them. - Mind: Its Console API is an early beta that may change. - Sources (read 2026-10-14): https://hookdeck.com/pricing, https://hookdeck.com/docs/console, https://hookdeck.com/docs/console/sources.md, https://hookdeck.com/docs/console/api.md ### Your own small receiver on Cloudflare Workers and D1 A small Worker that stores each request in a D1 database, which you read later. - Free: Workers: 100,000 requests a day. D1: 100,000 rows written a day, 5 GB. - Account and card: A Cloudflare account. - Without a server: Yes: nothing runs on your side, but you write and deploy the code. - Keeps: Until you delete it. Only you can read it. - Mind: Signature checks, protecting the read address and removing old rows are your job. - Sources (read 2026-10-14): https://developers.cloudflare.com/workers/platform/pricing/, https://developers.cloudflare.com/d1/platform/pricing/ ## While you develop ### Local forwarding while you develop Tools that pass webhooks to a port on your machine while they run: the Stripe CLI (stripe listen), the Hookdeck CLI, ngrok, smee.io. - Free: Free to use. ngrok's free plan: 20,000 requests a month. - Account and card: Stripe CLI: a Stripe login, or a sandbox it creates from an email address without one, which lasts 7 days unless claimed; for versions newer than 1.50.0 an admin must allow CLI access first. ngrok: an account. Hookdeck CLI: a guest account it creates itself. smee.io: none. - Without a server: No: a process must run on your machine, and your app must be up. - Keeps: They deliver only while they run. smee.io's server stores nothing, and its channels are not authenticated. - Mind: For development, not for an agent that is not running. - Sources (read 2026-10-14): https://docs.stripe.com/cli/listen, https://docs.stripe.com/cli/sandbox, https://docs.stripe.com/cli/login, https://hookdeck.com/docs/cli, https://ngrok.com/docs/pricing-limits/free-plan-limits/, https://ngrok.com/docs/share-localhost/quickstart.md, https://smee.io/, https://github.com/probot/smee.io ## Side by side | Way | Free, and its limits | Account and card | Without a server | How long, and who can read it | |---|---|---|---|---| | A route on the server you already run | No extra cost. | Nothing new. | No: it is your server. | As long as you keep it. Only you can read it. | | Reading the sender's own list of events | Part of those services. | An account with that sender. | Stripe: yes, you poll. GitHub: the webhook still needs an address to send to. | Stripe: 30 days. GitHub: 3 days. Read with your own account. | | webhook.site | At most 100 requests per address; the address and its data are removed after 7 days. | No account. | Yes. | 7 days. On the free version, the data is readable by anyone who knows the address's ID. | | Hookdeck | Developer plan: 10,000 events a month, 3 days of retention. Console: shows the most recent 250 requests of an address. | Console: no account. Developer plan: an account, no card. | Yes for receiving. Passing events on to your code needs a destination address or its command line tool. | Developer plan: 3 days. Console addresses are not private: anyone with the ID can read them. | | Your own small receiver on Cloudflare Workers and D1 | Workers: 100,000 requests a day. D1: 100,000 rows written a day, 5 GB. | A Cloudflare account. | Yes: nothing runs on your side, but you write and deploy the code. | Until you delete it. Only you can read it. | | AgentMart Webhook inbox | Not free: $1 per 30 days. | No sign-up form: your human's account is made by their first top-up, by card (at least $5), or by the free start. | Yes. | Each message 30 days while the plan runs. After a plan ends, only you can still read, export and delete what it stored, until our cleanup deletes it 30 days after the end. Only passports of the paying owner can use the instance. | ## When AgentMart fits Webhook inbox: A public HTTPS address that stores every POST or PUT it receives for 30 days, so your agent can read webhooks later. $1 per 30 days. Your human pays first, with a top-up of at least $5 by card, unless a new account uses the free start (its rules: https://agentmart.ciphyr.ai/llms/free-start.md). Unused balance expires 12 months after your last top-up or purchase. Any top-up or purchase starts the 12 months again. Our guarantee and your human's legal rights are in the terms. - Keeps every request it receives for 30 days, up to 1,000 messages and 20 MB in total; past those, the oldest messages are dropped. - Each body up to 256 KB; up to 60 requests a minute. - Anyone with its address can send to it. Reading: Only passports of the paying owner can use the instance. - Checking the sender's signature on arrival needs Webhook inbox pro on top ($2 per 30 days), or your own code. Ask your human before you buy: it spends their balance. Over MCP (https://agentmart.ciphyr.ai/mcp): ``` buy {"item": "webhook-inbox"} # Give the answer's inbox_url to the sender, then read what arrived: inbox_messages {"instance_id": ""} ``` Over HTTP, with a session token your signing code made (the manual's Auth page: https://agentmart.ciphyr.ai/llms/auth.md): ``` curl -X POST https://agentmart.ciphyr.ai/v1/orders \ -H "Authorization: Bearer $AGENTMART_SESSION" -H "Content-Type: application/json" \ -d '{"item": "webhook-inbox", "idempotency_key": "my-inbox-1"}' # delivery.inbox_url goes to the sender; read with delivery.instance_id: curl https://agentmart.ciphyr.ai/v1/utilities//messages -H "Authorization: Bearer $AGENTMART_SESSION" ``` ## When not to use AgentMart - Your project already runs a server: add a route instead. - You need webhooks kept longer than 30 days: store them in your own database. - Bodies over 256 KB, or more than 60 requests a minute. - Your human does not want to keep a prepaid balance. --- AgentMart is sold by Ciphyr Tech OÜ. Terms: https://agentmart.ciphyr.ai/terms. The agent manual: https://agentmart.ciphyr.ai/llms.txt.