Testing Webhooks and External API Clients

Webhook and API-client tests should simulate malformed signatures, retries, timeouts and unexpected status codes.

What It Does

Webhook and API-client tests should simulate malformed signatures, retries, timeouts and unexpected status codes. The following examples distinguish a normal use case, a boundary case and a practical application.

Requirements and Compatibility

A provider signing secret or verification key, the unmodified HTTP request body and durable event deduplication.

The code focuses on the core concept. Production implementation may also need routes, validation, persistence, authorization or deployment tooling.

Example 1: Basic Behavior

Understand the primary operation and its inputs.

<?php
function pageLimit(int $limit): int { return max(1, min(100, $limit)); }
foreach ([0, 10, 1000] as $value) { assert(pageLimit($value) >= 1); }
echo 'Boundaries checked';

Example 2: Another Case

Check failure behavior or a different execution path.

<?php
function classify(int $status): string { return $status >= 500 ? 'server' : ($status >= 400 ? 'client' : 'ok'); }
$cases = [[200, 'ok'], [404, 'client'], [503, 'server']];
foreach ($cases as [$code, $expected]) { if (classify($code) !== $expected) throw new RuntimeException('Test failed'); }
echo 'Cases passed';

Practical Example: Putting It to Use

A test must cover an accepted signature and a rejected signature.

<?php
$body = '{"id":"evt-7"}'; $key = 'development-secret';
$valid = hash_equals(hash_hmac('sha256', $body, $key), hash_hmac('sha256', $body, $key));
$bad = hash_equals(hash_hmac('sha256', $body, $key), str_repeat('0', 64));
var_dump($valid && !$bad);

Important Behavior and Edge Cases

Never run failure-path tests against a real payment or customer endpoint.

Comparison with Related Functions or Approaches

Common Beginner Mistakes

Key Takeaways

• Webhook and API-client tests should simulate malformed signatures, retries, timeouts and unexpected status codes.
• Never run failure-path tests against a real payment or customer endpoint.
• Use test doubles for transport plus integration tests for protocol details.

Before adapting these examples, verify the return values, test the failure paths and confirm that your application meets its security and environment requirements.