A request is a route, not a log line
Public webhook bins put someone else's payload (signatures, tokens, customer emails) on a server you do not own, under retention rules you do not set. Tunnels show the traffic only while the tunnel is up, and they remember nothing.
Lure runs on your machine. The screen shows all three stages at once: what arrived, what we answered, where it was forwarded and how that ended. The one that broke is always a specific one, and until now it had to be hunted in three different places. Replay reaches localhost: the service is already there.
What is inside
A three-stage pipeline
One row per request, the stages side by side. A click opens it in place: headers, the body raw and parsed, a ready curl.
Live feed without WebSocket
Server-Sent Events: the server sends only the id, the browser fetches the row itself and gets it in the language of its own tab.
You choose the answer
Status, content type, body and a delay up to 30 seconds. Half of a sender's bugs only show up on a 500 and on a timeout.
Forward and replay
Every incoming request can go on whole, and any recorded one can be replayed to any address. The outcome lands in the row's third stage.
Signatures masked
Authorization, *-signature, *-secret and Cookie show as sha256…6677 until you ask to see them. The toggle is pure CSS.
Zero runtime dependencies
node:http, node:sqlite, node:crypto and TypeScript with no build step: Node 24 runs the typed code directly. 21 tests on node:test.
Screenshots
