Mercur
Try it free

Security and data retention

Anyone with the URL can reach a public endpoint

A public endpoint has no inbound authentication. Mercur does not check tokens, signatures or API keys on traffic arriving at your URL — that is deliberate, because a webhook provider must be able to reach it, and only your own service knows how to verify the sender's signature.

Two consequences worth planning around:

  • Treat the endpoint URL as a secret. It is the only thing standing between the public and your local port while an endpoint is running in a forwarding mode.
  • Verify signatures in your own handler, exactly as you would in production.

When you do not want the endpoint open, set Public access to false and list the addresses allowed to reach it. Requests from anywhere else are refused with 403 Forbidden before they touch your machine.

What is stored

An HTTP endpoint records requests in Logging, or in Tunneling when Save full request & response is on (the default). Tunneling with that setting off stores nothing, which is the most common reason an HTTP log list looks empty.

When recording is on, an HTTP entry holds:

  • method, path and query string
  • request headers, up to 32 KB
  • a body preview, up to 256 KB
  • response status, headers and body, but only if response logging is enabled for that endpoint
  • timing, the caller's IP address and user agent

Anything larger than those caps is truncated, so a large upload is recorded as a preview rather than in full.

A WebSocket endpoint has no log-only mode. While it is running and an agent is claimed, Mercur stores each public client as a connection (handshake headers, path, state) plus lifecycle and data-frame events. Ping and pong are not stored. After 200 message events on one connection, later frames are dropped. Connection rows follow the same retention window as HTTP logs. Walkthrough: Inspect a WebSocket session.

Where it is stored, and for how long

Stored requests live on Mercur infrastructure, not on your machine, and are deleted 30 days after they arrive. Two other things remove them earlier:

  • reaching the stored-request cap for your plan, which drops the oldest entries
  • deleting the endpoint, which deletes its stored requests immediately

The webhook endpoint provisioned for you cannot be deleted, because the console depends on it existing. A guest endpoint and everything recorded on it are removed once the guest profile goes unused for 1 days.

How your machine is authorised

Forwarding runs through the macOS desktop app or the npm CLI. Each holds a credential for the machine and a token for each endpoint. Both are needed before the relay will route anything to you.

A running endpoint is claimed by one device, and the claim is refreshed while the app is running. If the app stops or loses its network, the claim lapses after 15 seconds and the public endpoint starts answering 503 instead of holding connections open. A second machine cannot take over an endpoint while the first still holds it.

Related