Security and data retention
Anyone with the URL can reach a public endpoint
A public endpoint has no inbound authentication. Mercur does not check tokens, signatures or API keys on traffic arriving at your URL — that is deliberate, because a webhook provider must be able to reach it, and only your own service knows how to verify the sender's signature.
Two consequences worth planning around:
- Treat the endpoint URL as a secret. It is the only thing standing between the public and your local port while an endpoint is running in a forwarding mode.
- Verify signatures in your own handler, exactly as you would in production.
When you do not want the endpoint open, set Public access to false and list the
addresses allowed to reach it. Requests from anywhere else are refused with 403 Forbidden before they touch your machine.
What is stored
An endpoint records requests only while it runs in a logging mode. An endpoint in proxy mode stores nothing at all, and that is the most common reason a log list looks empty.
When recording is on, an entry holds:
- method, path and query string
- request headers, up to 32 KB
- a body preview, up to 256 KB
- response status, headers and body, but only if response logging is enabled for that endpoint
- timing, the caller's IP address and user agent
Anything larger than those caps is truncated, so a large upload is recorded as a preview rather than in full.
Where it is stored, and for how long
Stored requests live on Mercur infrastructure, not on your machine, and are deleted 30 days after they arrive. Two other things remove them earlier:
- reaching the stored-request cap for your plan, which drops the oldest entries
- deleting the endpoint, which deletes its stored requests immediately
The webhook endpoint provisioned for you cannot be deleted, because the console depends on it existing. A guest endpoint and everything recorded on it are removed once the guest profile goes unused for 30 days.
How your machine is authorised
Forwarding runs through the desktop app, which holds a credential for the machine and a token for each endpoint. Both are needed before the relay will route anything to you.
A running endpoint is claimed by one device, and the claim is refreshed while the app is
running. If the app stops or loses its network, the claim lapses after
15 seconds and the public endpoint starts answering 503
instead of holding connections open. A second machine cannot take over an endpoint while
the first still holds it.