What Is a Webhook? Definition, Example and How It Works
A webhook (also written as web hook) is an automated way for one application to send real-time data to another application when a specific event occurs. Unlike traditional APIs where you request data, webhooks push data to you automatically.
A webhook is an HTTP callback
A webhook is an HTTP callback - a simple event-notification system via HTTP POST. When something happens in a source application, it makes an HTTP request to the URL configured for the webhook. This URL belongs to a receiving application, which can then take action based on the data received.
Think of webhooks as "reverse APIs" or "push APIs." Instead of polling for data repeatedly, your application subscribes to events and gets notified instantly when they occur.
Webhook vs API
Traditional API (Pull)
- You request data when needed
- Requires constant polling
- Higher resource usage
- Delayed data updates
Webhook (Push)
- Data pushed to you automatically
- Event-driven architecture
- Efficient resource usage
- Real-time data delivery
How do webhooks work?
Event Occurs
Something happens in the source application (payment completed, user signs up, file uploaded)
Webhook Triggered
The source application creates an HTTP POST request with event data
Data Sent
The POST request with payload is sent to your webhook endpoint URL
Processing
Your application receives and processes the webhook data
The payload is usually JSON, though some senders still use XML or form encoding, so check the Content-Type header before you parse. For any of this to work, the sender has to do two things: make outbound HTTP requests when something happens internally, and let you register the destination URL for the events you care about. To the receiver, a webhook is just another HTTP request, typically a POST, that your server has to accept and answer.
What is a Webhook Used For?
Payment Processing
Stripe, PayPal, and Square use webhooks to notify about successful payments, refunds, and disputes
Communication Apps
Slack, Discord, and Teams use webhooks for sending messages and notifications
Version Control
GitHub and GitLab trigger webhooks for code pushes, pull requests, and issues
E-commerce
Shopify and WooCommerce send webhooks for orders, inventory, and customer events
Webhook Example: Real-World Scenario
Online Store Order Processing
Your application receives this webhook and automatically: sends confirmation email, updates inventory, creates shipping label, and notifies fulfillment team.
Webhook security best practices
Verify Webhook Signatures
Always validate that webhooks come from trusted sources using HMAC signatures
Handle Idempotency
Process duplicate webhooks safely without side effects
Respond Quickly
Return 200 OK immediately and process asynchronously to avoid timeouts
Queue High Volumes
If you receive a lot of webhooks, put each one on a message queue and process it from there, so a burst of events cannot overwhelm your handler
Use HTTPS
Always use HTTPS endpoints to ensure data encryption in transit
Common Webhook Challenges
Challenges when working with webhooks
- Debugging: Hard to test locally without public URLs
- Reliability: Handling failed deliveries and retries
- Security: Validating webhook authenticity
- Monitoring: Tracking webhook performance and failures
The debugging and local-development pain in particular is why most teams reach for a free ngrok alternative that forwards public requests to their laptop, paired with a free webhook tester for inspecting the raw payload as it arrives.
How to test a webhook
Point the sender at a URL you can watch before you write any handler code. Open the free webhook listener to get a public URL with no signup, then fire a request at it from the provider's “send test webhook” button, from curl -X POST, or from the free webhook tester. The headers and body show up as they arrive, so you can see the exact payload and signature header your handler will get.
Anonymous URLs last up to 24 hours and keep up to 500 requests. Claim one into a free account to carry its captured requests over. When the handler runs on your laptop, forward the same deliveries to it with a tunnel, as described in how to test webhooks locally.
Debug webhooks with Hooklistener
Hooklistener is a webhook debugger for developing, testing, and monitoring webhooks: it gives you a URL to receive them, stores every request, and shows you the raw headers and body.