webhooks.xyz
AI Assistant · BYOK
BYOK = bring your own key. You add the API key of your AI provider; we never bill for AI. Open a request, press Explain, and get the fields that matter and what a handler must do. Press Handler in and get working code for that exact event, with signature verification. Ask a question in plain words. Summarise the last 24 hours of a bin in one click. The assistant uses your own key: you pay your provider, the assistant itself is free on every plan.
Providers
| Provider | Default model | Key |
|---|---|---|
| Anthropic | claude-sonnet-5-5 | get a key sk-ant-… |
| OpenAI | gpt-4.1-mini | get a key sk-… |
| Google Gemini | gemini-2.5-flash | get a key AIza… |
| Mistral | mistral-small-latest | get a key … |
| Groq | llama-3.3-70b-versatile | get a key gsk_… |
| OpenRouter | anthropic/claude-sonnet-4.5 | get a key sk-or-… |
Type any model name your provider offers; the default is only a start. OpenRouter gives one key for many models. Up to 6 keys per account; pick one per question when you have more than one.
Set up
- Sign up or sign in. Keys belong to an account, so anonymous bins show the assistant only after you sign in.
- Open Account → AI assistant. Pick the provider, paste the key, press Add and test. The test sends one short prompt and shows the provider's answer or error.
- Open a bin you own and select a request. The assistant bar is under the signature result.
What you can ask
| Button | What you get |
|---|---|
| Explain | Who sent it, what happened, the fields a handler needs and where they are, what the handler must do and must not do. |
| Handler in … | A minimal handler for exactly this event in Python (FastAPI), Node.js (Express), Go (net/http), Ruby (Sinatra), PHP, Java (Spring), C# (ASP.NET), Rust (axum): raw-body signature check, parsing, duplicate handling by event id, the right response code. |
| Suggest a filter | A rule in the actions filter syntax (field op value, one per line). Write what you want to keep in the Ask box first. |
| Ask | Any question about the selected request. |
| ✨ Summary | The last 24 hours of the bin: volume and timing, senders and events, signature failures, non-2xx answers, bursts and duplicates, what to look at first. |
Every answer is kept with the request. Select the request again and the last answer is shown; GET …/ai below lists them all.
What is sent to the provider
- Only the request you selected, only when you press a button. The summary sends one line per request (time, method, path, sender, event, signature status, response code, size), never bodies.
- Credential and signature headers are replaced by
[redacted]before the prompt is built:authorization,cookie,x-api-key, every header with "signature", "secret" or "token" in its name. - Bodies are cut at 12,000 characters.
- Your key is stored encrypted (same as connections) and sent only to its provider. We keep no copy of the provider's answer outside your account.
- Limit: 60 assistant calls an hour per account; one call waits at most 60 seconds.
API
curl -H "Authorization: Bearer whx_…" -H "Content-Type: application/json" \
-d '{"task": "explain"}' https://webhooks.xyz/api/v1/bins/k7f3abc/requests/42/ai
# task: explain | handler (+ "lang": "go") | filter (+ "question") | ask (+ "question")
# optional "key_id" from GET /api/v1/ai/keys
curl -H "Authorization: Bearer whx_…" -d '{"hours": 24}' https://webhooks.xyz/api/v1/bins/k7f3abc/ai/summary
curl -H "Authorization: Bearer whx_…" https://webhooks.xyz/api/v1/bins/k7f3abc/requests/42/ai # answers so far
Answers are Markdown in answer, with provider, model, tokens_in, tokens_out and ms. A provider failure returns HTTP 502 with error. The MCP server gives Claude, Cursor and other clients the raw requests instead, for their own models.