Expand first, theorize later
Log and email payloads often arrive as one ugly line. Hunting a missing comma by eye is a bad afternoon. Paste into JSON Formatter. If it expands, read the shape. If it doesn’t, the tool usually points near the break.
Usual suspects: trailing commas, single quotes, chopped strings, or an HTML error page that starts with < while everyone swears it’s JSON. Content-Type lying is more common than you’d like.
Two wrappers webhooks love
Some vendors Base64 the JSON. Decode first, then format. If decode is garbage, it may not be UTF-8 text, or you’re looking at the wrong field.
When a JWT sits inside the body, copy the token (no Bearer) into JWT Decoder and check exp / iss. Don’t paste signing secrets into any web tool.
Diff against yesterday’s contract
Sudden 400s after a vendor release: drop an old sample and a new one into JSON Diff. number → string, flattened objects — faster than reading a vague changelog.
If you do this weekly, save a pipeline: Base64 → JSON format (add JWT by hand when needed). Local processing is fine for staging. Still keep production secrets off the page.