Receiving a Webhook from a Low-Profile Page Directly in Your Code

Receiving a Webhook from Cardcom on the Development Computer Using Dev Tunnels

What does the tool enable?

Microsoft Dev Tunnels enables developers to receive a Webhook from Cardcom directly on a server running on the local computer (localhost).

The tool creates a public HTTPS address and routes requests from the internet to the local port on which the code is running. This makes it possible to test and handle the Webhook during development, without uploading the code to an external server and without opening an inbound port in the firewall.

Dev Tunnels is intended for development and testing purposes only, and not for use in a production environment.

How does it work?

For example, if the local server is running at:

http://localhost:5000

Dev Tunnels will generate a unique public address, for example:

https://example-5000.devtunnels.ms

When Cardcom sends a request to the public address, Dev Tunnels forwards it to the local server on port 5000.

If the endpoint in the code is:

/webhook

The full Webhook URL will be:

https://example-5000.devtunnels.ms/webhook

Prerequisites

Before getting started, make sure that:

Dev Tunnels is installed on the computer.
You have a Microsoft or GitHub account for signing in to the tool.
The local server is running and ready to receive requests.
You know which port the local server is running on.
The code includes an endpoint for receiving the Webhook.
The computer is connected to the internet and allows outgoing communication with the Dev Tunnels service.

Step 1: Installing Dev Tunnels

On a Windows computer, open PowerShell or Command Prompt and run:

winget install Microsoft.devtunnel

After installation, verify that the tool is available by running:

devtunnel --version

For installation instructions on Windows, macOS, or Linux, see the official Microsoft guide.

Step 2: Signing in to the tool

Run:

devtunnel user login

Then complete the sign-in process using your Microsoft account.

You can also sign in using a GitHub account:

devtunnel user login -g

Signing in is required to create and manage the tunnel. The --allow-anonymous option does not eliminate the developer's need to sign in to the tool.

Step 3: Starting the local server

Start the project and verify that the server is available on localhost.

For example:

http://localhost:5000

Use the port on which the server is actually running. If the project is running on a different port, replace 5000 with the appropriate port.

It is recommended to test the endpoint locally before creating the tunnel, for example:

http://localhost:5000/webhook

Step 4: Creating a Dev Tunnel

Once the local server is running, open another PowerShell or Command Prompt window and run:

devtunnel host -p 5000 --allow-anonymous

Command details:

devtunnel host – creates a tunnel from the local computer.
-p 5000 – forwards traffic to local port 5000.
--allow-anonymous – allows an external system, such as Cardcom, to access the address without signing in to a Microsoft account.

When the command finishes running, a unique public HTTPS address will be displayed, for example:

Hosting port 5000 at https://example-5000.devtunnels.ms/

Keep the command window open while testing.

Step 5: Configuring the Webhook URL

Copy the HTTPS address you received and append the path of the endpoint in the code.

For example:

https://example-5000.devtunnels.ms/webhook

Provide the full URL to Cardcom as the Webhook URL, according to the implementation method you are using, for example as part of a low-profile page request.

Make sure that:

The address begins with https://.
The endpoint path is included in full.
Do not use localhost as the Webhook URL.
The tunnel and local server are running when the request is sent.

Configuring the Webhook URL in Cardcom's JSON interface:

When creating the payment page – Create a new Iframe \ Redirect page
Enter the URL in the WebHookUrl field:

Step 6: Performing a test

Perform the action that should cause Cardcom to send the Webhook, such as a test transaction on a low-profile page.

Then check:

Whether a request was received at the local endpoint.
Whether the request method and path match the implementation.
Whether the expected data was received.
Whether the code returned the response required by Cardcom according to the interface being used.
Whether errors were recorded in the project logs.

Do not rely solely on opening the tunnel address in a browser. A Webhook may be sent using a request method different from the regular GET request sent by a browser.

Viewing received requests

When the tunnel is started, the tool may also display an address for inspecting traffic, labeled Inspect URL.

This address can be used to view requests that passed through the tunnel and check, among other things:

When the request was sent.
The destination address.
The request method.
The headers that were sent.
The request body.
The response returned by the local server.

This option helps distinguish between two situations:

Cardcom did not send a request, or the request did not reach the tunnel.
The request reached the tunnel but was not handled correctly by the local code.

Stopping the tunnel

To stop the tunnel, switch to the window in which it is running and press:

Ctrl+C

The command described in this guide creates a temporary tunnel. After it is stopped, the address you received will no longer work. A new address may be assigned the next time it is started, in which case the Webhook URL will need to be updated.

Security notes

Using --allow-anonymous allows Cardcom to send requests to the tunnel without an authentication process, but it also makes the address accessible over the internet to anyone who knows or manages to discover it.

Therefore:

Use the tool for development and testing purposes only.
Do not use it as a permanent Webhook URL in a production environment.
Do not expose sensitive information that is not required for testing.
It is recommended to run the tunnel only during testing and stop it afterward.
Do not leave dangerous operations exposed at the test address without protective mechanisms.
Do not publish the tunnel address in public channels.

Microsoft notes that a tunnel with anonymous access allows anyone who reaches the address to connect to the local server. More information is available in the Dev Tunnels security documentation.

Common issues

No request was received by the code

Make sure that:

The local server is running.
The tunnel is still active.
The correct port was selected.
The Webhook URL includes the full path.
The updated tunnel address was configured in the request.
The endpoint supports the request method being sent.
There is no error in the code when receiving the request.

A Connection Refused error was received

The error may indicate that the tunnel is active, but no server is listening on the configured port.

Check which port the project is running on and run the command again, for example:

devtunnel host -p PORT --allow-anonymous

Replace PORT with the actual port number.

The tunnel was probably started without anonymous access enabled.

Stop it and start it again using:

devtunnel host -p 5000 --allow-anonymous

The address worked before but is now unavailable

The tunnel created by the command is temporary. If the command window was closed or the process stopped, the tunnel is no longer active.

Start it again and update the Webhook URL if a new address was assigned.

The request appears in the inspection tool but not in the code

Check that:

The path in the code matches the path in the URL.
The endpoint supports the request method.
The application is listening on the correct port.
There is no software error while processing the request.
The server does not restrict the host name or the request origin.

The tool is not recognized after installation

Close and reopen PowerShell or Command Prompt, then check:

devtunnel --version

If the issue persists, verify that the installation completed successfully and that the tool's location was added to the PATH variable.

Summary

Dev Tunnels enables you to receive a Webhook from Cardcom directly in the local development environment using a temporary public HTTPS address. This shortens testing times, allows you to debug the request in the code in real time, and eliminates the need to upload a version to an external server or open an inbound port in the firewall.

The main command:

devtunnel host -p 5000 --allow-anonymous

Adjust the port number to match the development environment, keep the tunnel active during testing, and stop it afterward.