Test GitHub webhook events and CI callbacks

GitHub signs every webhook delivery with an HMAC-SHA256 signature in the X-Hub-Signature-256 header. Use the Webhook Debugger to confirm your webhook secret is correct, inspect individual push, pull request, and deployment events, and replay a specific delivery to staging without waiting for the next real trigger.

Configure the actor for GitHub

Start the actor with the following input. Replace replace_with_github_webhook_secret with the secret you set in GitHub’s webhook settings.

{
  "urlCount": 1,
  "retentionHours": 48,
  "authKey": "github-debug-key",
  "enableJSONParsing": true,
  "maskSensitiveData": true,
  "signatureVerificationSecret": "replace_with_github_webhook_secret",
  "signatureVerification": {
    "provider": "github"
  },
  "defaultResponseCode": 200,
  "defaultResponseBody": "{\"received\":true}",
  "forwardUrl": "https://staging.example.com/github/webhooks",
  "forwardHeaders": true,
  "replayMaxRetries": 3,
  "replayTimeoutMs": 10000,
  "alerts": {
    "slack": {
      "webhookUrl": "https://hooks.slack.com/services/AAA/BBB/CCC"
    }
  },
  "alertOn": ["signature_invalid", "5xx"]
}

GitHub verification uses the X-Hub-Signature-256 header with a required sha256= prefix. The actor verifies the signature against the preserved raw request body, so the result stays valid even when enableJSONParsing is enabled. After the actor starts, call /info to retrieve the generated webhook URL.

Point your GitHub webhook at the generated URL

Open webhook settings

For a repository webhook, go to Settings → Webhooks → Add webhook. For a GitHub App, go to Developer settings → GitHub Apps → your app → Edit → Webhook.

Paste the endpoint URL

Copy the /webhook/:id URL from /info and paste it into the Payload URL field.

Set the content type

Set Content type to application/json.

Add the secret

Paste your webhook secret into the Secret field and copy the same value into signatureVerification.secret in the actor input.

Select events

Choose which events to send — Just the push event, Send me everything, or a custom selection that matches your CI workflow.

Inspect push, PR, and deployment events

After GitHub delivers a webhook, query /logs to see what was captured. Filter by the X-GitHub-Event header to isolate a specific event type:

GET /logs?webhookId=wh_abc123&headers.x-github-event=push

Look up a specific delivery by the ID GitHub shows in the webhook delivery history:

GET /logs?webhookId=wh_abc123&headers.x-github-delivery=<delivery-id>

A captured push event looks like this:

{
  "id": "evt_8m2L5p9xR",
  "webhookId": "wh_abc123",
  "timestamp": "2026-01-30T12:00:00.000Z",
  "method": "POST",
  "statusCode": 200,
  "signatureValid": true,
  "signatureProvider": "github",
  "headers": {
    "x-github-event": "push",
    "x-github-delivery": "abc-123-def-456"
  },
  "body": {
    "ref": "refs/heads/main",
    "repository": {
      "full_name": "org/repo"
    }
  }
}

signatureValid: true confirms the actor verified X-Hub-Signature-256 against your secret. To check for signature failures:

GET /logs?webhookId=wh_abc123&signatureValid=false

Debug CI callback failures with replay

If a CI or deployment callback reached the actor but failed downstream, check /system/metrics for forwarding error details. Once you fix the downstream target, replay the original captured delivery to staging:

curl -X POST \
  "https://<run-id>.runs.apify.net/replay/wh_abc123/evt_8m2L5p9xR?url=https%3A%2F%2Fstaging.example.com%2Fgithub%2Fwebhooks"

The replay uses the original captured method and payload, so your staging handler receives the same delivery GitHub originally sent.

Use responseDelayMs in the actor input or append ?__status=500 to the webhook URL to simulate failure responses and test your CI error-handling paths before production changes.

Common failure patterns

Signal	What it usually means	What to do
`signatureValid=false`	Wrong webhook secret or missing `sha256=` prefix in the incoming header	Re-check the GitHub webhook secret and inspect the captured raw request
Missing expected `action` field	The event type doesn’t include the payload shape your workflow assumed	Filter by `headers.x-github-event` first, then inspect the parsed body for that event family
Forwarding failures	GitHub reached the actor but forwarding to your staging bridge failed later	Fix the downstream target, then replay the original delivery by log ID

Get Started

Core Features

Security

Configuration

Guides

Help

Test GitHub webhook events and CI callbacks

Configure the actor for GitHub

Point your GitHub webhook at the generated URL

Inspect push, PR, and deployment events

Debug CI callback failures with replay

Common failure patterns

​Configure the actor for GitHub

​Point your GitHub webhook at the generated URL

​Inspect push, PR, and deployment events

​Debug CI callback failures with replay

​Common failure patterns

Configure the actor for GitHub

Point your GitHub webhook at the generated URL

Inspect push, PR, and deployment events

Debug CI callback failures with replay

Common failure patterns