Test TRON webhook integrations offline

Updated: 2026-10-19. https://tronhooks.com/docs/ai/examples/

Start with the OpenAPI contract and signature verification guide. Keep API keys and webhook secrets in environment variables, never in a URL or a public example.

# Review the inputs first. Running this POST creates a real watch.
# Set TRONHOOKS_API_KEY in your local secret environment, never in a URL.
curl --disable --fail-with-body https://tronhooks.com/v1/watches \
  -H "Authorization: Bearer $TRONHOOKS_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"address":"YOUR_TRON_ADDRESS","asset_filter":"USDT","direction":"incoming","webhook_url":"https://YOUR_RECEIVER.example/webhook"}'

Receiver acceptance checklist

Use a local fixture and a local secret. This does not need a real watch or chain transaction.

1. Compute an HMAC-SHA256 over the exact fixture bytes. A matching signature must pass; a changed byte, wrong key, missing signature and malformed signature must fail.
2. Send the same event_id twice. Only one durable inbox row and one downstream credit may result.
3. Restart the receiver and replay it. An in-memory Set is insufficient for production deduplication.
4. Preserve decimal strings and validate the event before processing. A transfer.confirmed notification is not an instruction to send funds.
5. Verify pagination until next_cursor is null. For uncertain writes, list existing watches and compare the full destination before retrying.

The TypeScript SDK 0.2.0 includes signature helpers, Telegram watch types and stable cursor iteration. Verify the SHA-256 manifest; registry publication is tracked separately. Read the installed version's types. Platform integration explains the durable-inbox pattern; error handling explains quota and retry decisions.

Do not call the console's test-notification action as part of routine integration acceptance. It sends a real message.

Download and run offline

• Node receiver: node receiver.mjs --self-test (Node 22.13+).
• Python receiver: python3 receiver.py --self-test (Python 3.9+).
• cURL create helper: previews by default; --create is an explicit real write.
• Setup and operational limits: local SQLite inbox, reverse proxy, worker responsibilities and reconciliation.

Both receivers test raw-body signatures, malformed inputs, durable deduplication after restart, conflicting same-ID payloads, decimal precision and storage failure. They accept and store notifications; they do not implement a payment ledger.

Markdown · Capabilities JSON