What is Webhook?

A webhook is a mechanism through which one system automatically notifies another when an event happens. Instead of your server constantly asking "has anything changed yet?", it registers a URL and waits — when the event occurs, the other system sends an HTTP request to that URL with the data.

Hence the classic description: a webhook is an API in reverse. With a traditional API, you are the caller; with a webhook, you are the one being called.

Polling versus webhook

Without a webhook, the alternative is polling: querying the API at regular intervals to check for changes. The cost is high — if you poll every minute and the event happens once a day, 1,439 calls were wasted, and the news can still arrive up to a minute late.

Rules for receiving webhooks safely

Your webhook URL is public — anyone can discover it and send fake data. That makes a few precautions non-optional:

• Validate the signature. Serious providers sign the request body with a shared secret (HMAC). Recompute the hash and compare it before trusting any data.
• Respond fast, process later. Return 200 in milliseconds and push the heavy work onto a queue. Providers usually treat a timeout as a failure and resend.
• Handle duplicates. Redeliveries happen. Use the event ID to guarantee idempotency — processing the same webhook twice must not charge the customer twice.
• Never trust the payload alone. For sensitive operations, query the provider’s API to confirm the real state before acting.
• Require HTTPS. Event data usually contains sensitive information.

Where webhooks are used

Payment gateways announcing that a charge was approved or refunded. GitHub triggering the CI pipeline on every push. Email platforms reporting that a message bounced. Automation tools like n8n, Zapier and Make run almost entirely on webhooks — the topic comes up closely in the article on chatbot automation tools.

Testing during development

The challenge of developing with webhooks is that localhost is not reachable from the internet. The usual solution is a tunnel — tools like ngrok or Cloudflare Tunnel expose your local machine on a temporary public URL, letting you receive real events during development.