# Test TRON webhook integrations offline

Updated: 2026-10-19. https://tronhooks.com/docs/ai/examples/

Start with the [OpenAPI contract](/docs/openapi.json) and [signature verification guide](/docs/webhooks/). Keep API keys and webhook secrets in environment variables, never in a URL or a public example.

```sh
# Review the inputs first. Running this POST creates a real watch.
# Set TRONHOOKS_API_KEY in your local secret environment, never in a URL.
curl --disable --fail-with-body https://tronhooks.com/v1/watches \
  -H "Authorization: Bearer $TRONHOOKS_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"address":"YOUR_TRON_ADDRESS","asset_filter":"USDT","direction":"incoming","webhook_url":"https://YOUR_RECEIVER.example/webhook"}'
```

## Receiver acceptance checklist

Use a local fixture and a local secret. This does not need a real watch or chain transaction.

1. Compute an HMAC-SHA256 over the exact fixture bytes. A matching signature must pass; a changed byte, wrong key, missing signature and malformed signature must fail.
2. Send the same `event_id` twice. Only one durable inbox row and one downstream credit may result.
3. Restart the receiver and replay it. An in-memory Set is insufficient for production deduplication.
4. Preserve decimal strings and validate the event before processing. A `transfer.confirmed` notification is not an instruction to send funds.
5. Verify pagination until `next_cursor` is null. For uncertain writes, list existing watches and compare the full destination before retrying.

The [TypeScript SDK 0.2.0](/docs/ai/packages/tronhooks-sdk-0.2.0.tgz) includes signature helpers, Telegram watch types and stable cursor iteration. Verify the [SHA-256 manifest](/docs/ai/packages/manifest.json); registry publication is tracked separately. Read the installed version's types. [Platform integration](/docs/use-cases/platform-deposits/) explains the durable-inbox pattern; [error handling](/docs/ai/) explains quota and retry decisions.

Do not call the console's test-notification action as part of routine integration acceptance. It sends a real message.

## Download and run offline

- [Node receiver](/docs/ai/examples/receiver.mjs): `node receiver.mjs --self-test` (Node 22.13+).
- [Python receiver](/docs/ai/examples/receiver.py): `python3 receiver.py --self-test` (Python 3.9+).
- [cURL create helper](/docs/ai/examples/create-watch.sh): previews by default; `--create` is an explicit real write.
- [Setup and operational limits](/docs/ai/examples/README.md): local SQLite inbox, reverse proxy, worker responsibilities and reconciliation.

Both receivers test raw-body signatures, malformed inputs, durable deduplication after restart, conflicting same-ID payloads, decimal precision and storage failure. They accept and store notifications; they do not implement a payment ledger.