What is a Webhook? A Complete Guide for Beginners

If you have ever wondered what a webhook is and how it works, this guide is for you. We will explain webhooks in simple terms, show real-world examples, and help you understand why they are essential for modern applications.

The Simple Explanation

Think of a webhook like a pizza delivery notification.

Without webhooks (polling): You keep calling the pizza place asking "Is my pizza ready?" every 5 minutes. Wastes your time and theirs.

With webhooks: The pizza place calls YOU when your pizza is ready. You get notified instantly, no wasted calls.

That is exactly how webhooks work in software. Instead of your application constantly asking a server "Is there new data?", the server sends your application a notification when something happens.

How Webhooks Work

Here is the step-by-step flow:

Step 1: You Register a URL

You tell a service: "When something happens, send data to this URL." This URL is your webhook endpoint — a piece of code on your server that listens for incoming requests.

Step 2: Something Happens

An event occurs in the service — a payment succeeds, a user signs up, an order ships, a code commit is pushed.

Step 3: The Service Sends a POST Request

The service sends an HTTP POST request to your URL with the event data (called a "payload"). This happens automatically, in real-time.

Step 4: Your Server Processes It

Your server receives the data and takes action — updates a database, sends an email, triggers a workflow, or notifies a user.

Real-World Examples

Here are common webhook use cases you probably encounter every day:

• 
  Payment notifications — Stripe sends a webhook when a payment succeeds or fails


• 
  CI/CD pipelines — GitHub sends a webhook when code is pushed, triggering a build


• 
  Chat bots — Slack or Discord sends a webhook when a message is posted


• 
  E-commerce — Order created, shipped, delivered — each triggers a webhook


• 
  AI agents — An AI agent sends a webhook when a task completes


• 
  Monitoring — An alert system sends a webhook when a server goes down

Webhook vs API vs Polling

Understanding the difference between these approaches is crucial:

When to Use Polling

• The API does not support webhooks


• You need very infrequent updates (daily or weekly)


• You are building a quick prototype

When to Use Webhooks

• You need real-time updates


• High volume of events


• You want to reduce API calls


• Building production integrations

Webhook Security

Webhooks are sent over HTTP, so anyone can send a request to your URL. You need to verify that the request actually came from the expected service.

HMAC Signatures

The most common verification method. The service signs the payload with a secret key. You verify the signature on your end using the same secret.

HTTPS Only

Always use HTTPS for your webhook endpoints. Never accept webhooks over plain HTTP in production.

Timestamp Validation

Check the timestamp in the webhook header. Reject requests older than 5 minutes to prevent replay attacks.

Getting Started with Webhooks

The easiest way to start with webhooks:

1. 
   Create an endpoint on your server (a URL that accepts POST requests)


2. 
   Register that URL with the service that will send webhooks


3. 
   Verify the webhook signature in your endpoint


4. 
   Process the event data and take action


5. 
   Return a 200 status code to acknowledge receipt

Pro Tip

Use a webhook service like — 10,000 webhooks per month, no credit card required.

Originally published at hooksniff.vercel.app/blog/what-is-a-webhook