Test PagerDuty webhooks locally

Receive PagerDuty events on your laptop while you build, with a URL PagerDuty can reach.

Horizon has no PagerDuty integration. PagerDuty sends webhooks to a public URL, and Horizon provides that URL.

Before you beginCopy Anchor Link

• Node.js 18 or later
• A Horizon account and the CLI (see Getting started)
• A reserved subdomain for -s. Reserve one on the Subdomains page.
• A Next.js app that uses the App Router and runs on port 3000
• A PagerDuty account where you can add webhook subscriptions

import { createHmac, timingSafeEqual } from "node:crypto";

export async function POST(request: Request) {
  const secret = process.env.PAGERDUTY_WEBHOOK_SECRET;
  if (!secret) {
    return new Response("Missing PAGERDUTY_WEBHOOK_SECRET", { status: 500 });
  }

  const body = await request.text();
  const header = request.headers.get("x-pagerduty-signature") ?? "";
  const expected = Buffer.from(
    `v1=${createHmac("sha256", secret).update(body).digest("hex")}`,
  );

  const isValid = header.split(",").some((signature) => {
    const received = Buffer.from(signature.trim());
    return received.length === expected.length && timingSafeEqual(received, expected);
  });

  if (!isValid) {
    return new Response("Invalid signature", { status: 401 });
  }

  const payload = JSON.parse(body);
  console.log(`Received PagerDuty event: ${payload.event?.event_type}`);

  return new Response("ok", { status: 200 });
}

PAGERDUTY_WEBHOOK_SECRET=replace-with-your-subscription-secret

npm run dev

hrzn tunnel http://localhost:3000 -s my-pagerduty-app

HORIZON: Tunnel connected
  URL          https://my-pagerduty-app.hrzn.run (reserved)
  Forwarding   http://localhost:3000
  Request log  https://hrzn.run/dashboard/tunnels/my-pagerduty-app

Check it worksCopy Anchor Link

In the terminal that runs hrzn, you see one line for the delivery:

  POST    200  /api/webhooks/pagerduty

Your app terminal prints Received PagerDuty event: followed by the event type. Every V3 payload carries one event object with an event_type, for example incident.priority_updated.

If the line shows [401], see Troubleshooting.

TroubleshootingCopy Anchor Link

The signature doesn't matchCopy Anchor Link

• Check that PAGERDUTY_WEBHOOK_SECRET is the secret of this subscription, with no extra spaces or newline.
• Hash the raw body. Don't run JSON.parse and JSON.stringify first.
• Compare against every comma-separated value in the header, not only the first.
• Restart npm run dev after you edit .env.local.

PagerDuty stops sending eventsCopy Anchor Link

PagerDuty retries timeouts, 5xx and 429 responses for up to 48 hours. It drops other 4xx responses without a retry. After 3 consecutive delivery failures, it disables the subscription for 24 hours. Fix the handler, then send a new test event.

The URL changed after a restartCopy Anchor Link

You started the tunnel without -s, so Horizon gave you a new random subdomain. Restart with -s my-pagerduty-app and the URL stays the same. -s needs a subdomain you reserved, see Pricing.

Nothing reaches your appCopy Anchor Link

• Check that the Horizon terminal is still running. If its last line is Connection lost. Reconnecting…, wait for Reconnected.
• Check that Webhook URL ends with /api/webhooks/pagerduty.

Next stepsCopy Anchor Link

• Read PagerDuty's guide to verifying webhook signatures.
• Read how PagerDuty handles retries and failures.