Webhook
A mechanism for one application to send real-time data to another when a specific event occurs, using HTTP callbacks instead of polling.
Detailed Explanation
Webhooks are "reverse APIs"—instead of your application requesting data from a server, the server pushes data to your application when something happens. You provide a URL (webhook endpoint), and the other service sends an HTTP POST request to that URL with event data.
Webhooks are used for: payment confirmations (Stripe sends a webhook when payment succeeds), CI/CD triggers (GitHub sends a webhook when code is pushed), chat notifications (Slack sends a webhook when a message is posted), and integration workflows (Zapier connects services via webhooks). Implementing webhooks requires handling incoming HTTP requests, verifying the sender's identity, processing the event data, and returning a 2xx response quickly.
Why It Matters
Webhooks enable real-time integrations between services. They are essential for payment processing, CI/CD, notifications, and building connected systems.
Real-World Example
When a customer pays on Stripe, Stripe sends a webhook to your server with payment details. Your server updates the order status, sends a confirmation email, and activates the subscription—all triggered by the webhook.
When to Use
When you need real-time notifications from external services, when polling would be inefficient, or when building event-driven integrations.
Advantages
- Real-time data delivery
- No need to poll for updates
- Simple to implement (HTTP POST)
- Widely supported by third-party services
- Efficient use of resources
Disadvantages
- Requires a publicly accessible endpoint
- No guaranteed delivery (need retry logic)
- Security concerns (verify webhook signatures)
- Order of events not guaranteed
- Difficult to debug failed webhooks
Related Terms
Frequently Asked Questions
What is the difference between a webhook and an API?
An API is pull-based: you request data when you need it. A webhook is push-based: data is sent to you when something happens. Use APIs for on-demand queries and webhooks for real-time event notifications.
How do I secure webhooks?
Verify the webhook signature using the provider's secret key. Most providers (Stripe, GitHub) sign their webhooks. Also use IP allowlisting, validate the payload schema, and process events idempotently.
What happens if my webhook endpoint is down?
Most providers implement retry logic (e.g., Stripe retries for 3 days). Your endpoint should return a 2xx quickly (under 5 seconds) and process events asynchronously. Use a queue to handle webhook processing reliably.
How do I test webhooks locally?
Use tools like ngrok, Stripe CLI, or Cloudflare Tunnel to expose your local server to the internet. Then configure the webhook provider to send events to your local URL.
What is webhook idempotency?
Idempotency means processing the same webhook event multiple times produces the same result. Since providers may retry webhooks, your handler must be idempotent—use event IDs to deduplicate processing.