Architecture
How Anonymily works
A thin, secure relay layer between any webhook provider and your local machine. No tunnels. No open ports. Events arrive in milliseconds.
Pulls events over SSE, forwards verbatim to localhost. Runs on your machine — no inbound ports needed.
Inspect events, replay them, search history, run AI diagnosis. Browser-based — no CLI needed.
Receives the original request — same headers, same raw body. Your handler never knows it came through a relay.
Step by step
Provider fires a webhook
The request hits api.anonymily.com/h/<id>. Anonymily stores the raw event and responds 200 immediately — the provider marks it delivered and never retries.
Edge verifies the signature
For supported providers (Stripe, GitHub, Shopify, Slack, Razorpay) Anonymily checks the HMAC signature against the provider secret you configured. Invalid signatures are rejected before your server sees them.
CLI receives the event over SSE
The CLI holds a persistent Server-Sent Events connection to the API. New events are pushed over that stream with sub-100 ms latency — no polling, no long-polling, no WebSocket framing overhead.
CLI forwards verbatim to localhost
The CLI replays the full original request to your local port — identical method, headers, and raw body. Your handler code is unaware it came through a relay and can verify signatures normally.
Core concepts
A unique inbound URL: api.anonymily.com/h/<id>. Anonymous endpoints get a random ID each session. Named endpoints keep the same ID across CLI restarts — paste it once into your provider, never touch it again. A free account includes 1 named endpoint; Pro unlocks unlimited.
A single captured HTTP request. Stores method, headers, raw body, timestamps, and the response status your local server returned. Queryable and replayable from both the Dashboard and CLI.
The persistent record that owns a set of events. Each hook has a stable signing secret, optional provider preset, and configurable custom response (Pro).
The live SSE connection the CLI holds. One relay = one CLI session. Multiple team members can relay the same hook simultaneously on the Pro team tier.
Security model
Anonymily never modifies request bodies. Your server verifies signatures against the unaltered raw payload — the relay is fully transparent.
All traffic — inbound webhooks, CLI SSE stream, Dashboard API — is encrypted in transit.
Raw event bodies are encrypted at rest. Access to production databases is audited.
CLI auth uses short-lived JWTs issued against your Personal Access Token. Tokens are revokable.