What Is a Webhook? Definition, examples, and use cases

Definition

A webhook is an HTTP callback that sends data from one application to another in real time when a specific event occurs. Unlike traditional APIs where the consuming application must poll (repeatedly request) for new data, webhooks push data to a designated URL immediately after the triggering event. This event-driven communication pattern eliminates polling overhead and enables near-instant data synchronization between systems.

The receiving application registers a webhook by providing a URL endpoint to the sending application. When the specified event occurs (e.g., a customer places an order, a payment is processed, a file is uploaded), the sending application makes an HTTP POST request to the registered URL with event data in the request body, typically formatted as JSON.

How Webhooks Work

1. Registration: Application B provides Application A with a callback URL (e.g., https://app-b.com/webhook/orders).
2. Event occurs: A customer places an order in Application A.
3. HTTP POST: Application A sends an HTTP POST request to Application B's callback URL with order data in the JSON body.
4. Processing: Application B receives the request, validates the payload, and processes the data (creates a record, triggers a workflow, sends a notification).
5. Response: Application B returns an HTTP 200 status code to confirm receipt. If Application B returns an error, Application A may retry the delivery.

Webhooks vs Polling vs WebSockets

Webhook Security Considerations

• Signature verification: Sending applications sign webhook payloads with a shared secret (HMAC-SHA256). The receiver verifies the signature to confirm the request came from the expected sender. Stripe, GitHub, Shopify, and most SaaS platforms include signatures in webhook headers.
• HTTPS enforcement: Webhook URLs should always use HTTPS to encrypt data in transit.
• IP whitelisting: Some organizations restrict webhook receipt to known IP ranges of the sending application.
• Replay protection: Include timestamps in webhook payloads and reject payloads older than a threshold (e.g., 5 minutes) to prevent replay attacks.
• Idempotency keys: Include unique event IDs so the receiver can detect and ignore duplicate deliveries.

Webhooks in Automation Platforms

Webhooks are the primary trigger mechanism in modern automation platforms:

When a SaaS application supports webhooks, automation platforms use them for instant triggers. When webhooks are unavailable, platforms fall back to polling (checking for changes at intervals), which introduces latency and consumes API quota.

Common Webhook Events by Application

• Stripe: payment_intent.succeeded, customer.created, invoice.paid, charge.refunded
• GitHub: push, pull_request.opened, issues.created, workflow_run.completed
• Shopify: orders/create, products/update, customers/create, fulfillments/create
• Slack: message.channels, app_mention, reaction_added, member_joined_channel

Use Cases

• Payment processing: Stripe webhook fires when payment succeeds, triggering order fulfillment, receipt generation, and CRM update.
• CI/CD: GitHub webhook fires on pull request merge, triggering build, test, and deployment pipeline.
• Customer notifications: E-commerce webhook fires on shipping status change, triggering SMS and email notifications to the customer.
• Data synchronization: CRM webhook fires on contact update, triggering sync to email marketing platform and data warehouse.