What is a webhook?
An HTTP request one system fires to another the moment something happens, carrying the details of that event.
Webhook — A webhook is an HTTP request one system sends to another when an event happens — a form submission, a booking, a deal won — carrying the event's data. It is the simplest way to connect systems without polling.
Why it matters
Two systems that need to stay in sync have two basic options: one can repeatedly ask the other "has anything changed yet", which is polling, or the system where the event happens can simply tell the other system the moment it occurs. A webhook is that second approach: when an event fires, such as a form submission, a booking, or a deal being marked won, the source system sends an HTTP request to a URL the receiving system provided in advance, carrying the event's data in the request body. The receiving system does not have to ask; it is told.
Two things separate a reliable webhook integration from a fragile one. The first is signing: without a way to verify a webhook actually came from the system it claims to, anyone who guesses or discovers the receiving URL can send fake events. The second is retrying: a webhook is a single HTTP request, and if the receiving system is briefly down or the request fails to deliver, an unretried webhook simply drops that event with no second attempt, silently. A webhook integration that skips either of these looks like it works in testing and then quietly loses data in production the first time something goes wrong.
How a webhook delivery works
- 1
A receiving URL is registered
The destination system provides a URL to receive events in advance.
- 2
An event occurs
Something happens in the source system, such as a form being submitted.
- 3
The source system sends a request
An HTTP request carrying the event's data is sent to the registered URL.
- 4
The request is signed
A signature lets the receiver verify the request genuinely came from the source.
- 5
Failed deliveries are retried
If the request fails, it is attempted again rather than dropped silently.
The mistake to watch for
Questions
- How is a webhook different from an API call?
- A webhook is a push: the system where the event happened sends data to the receiver without being asked. A typical API call is a pull: the receiving system has to actively request data, often by polling repeatedly to check for changes.
- Why does a webhook need to be signed?
- Without a signature, anyone who discovers or guesses the receiving URL can send fake events that look legitimate. A signature lets the receiver verify the request actually came from the claimed source before acting on it.
- What happens if a webhook delivery fails?
- Without a retry mechanism, a failed delivery is simply lost, and the receiving system never learns the event happened. A reliable webhook system retries failed deliveries rather than treating one failed attempt as final.