Webhook
Also known as: web hook, webhooks, HTTP callback, web callback
A webhook is a way for one app to automatically notify another the moment an event happens, by sending a message to a web address the other app provides.
For example, a payment processor can send a webhook when a payment succeeds, or a form tool can send one when someone submits a form. Instead of constantly asking 'anything new?', systems simply wait to be told. While webhooks make integrations fast and efficient, they need security checks so fake messages can't trigger actions.
Webhook, explained at three levels
At home
A webhook is like a doorbell. Instead of checking the door every few minutes, you wait for the bell to ring when someone arrives.
At work
Webhooks let systems react instantly, such as sending a receipt the moment a customer pays.
At home
Tools like Zapier or Make use webhooks to connect apps, such as posting a message to a group chat whenever a new form is submitted.
At work
Webhook receivers should verify signatures, respond quickly, handle retries and duplicate deliveries, and process work in the background so slow tasks don't time out.
At home
Anyone who learns a webhook address may be able to send fake messages to it. In my opinion, keep those addresses private like passwords.
At work
Validate signatures and timestamps to stop forged or replayed events, make processing idempotent, log deliveries, monitor failures, and protect against server-side request forgery when users can configure webhook destinations.
Real-world examples
At home
Fatima runs a small online shop. A webhook from her payment provider automatically adds each new order to her spreadsheet.
At work
Jerome builds integrations at a Regina software firm. He added signature checks to their webhook endpoint after spotting fake requests in the logs.
How it compares
| feature | Webhook | API polling |
|---|---|---|
| Direction | Server pushes events | Client asks repeatedly |
| Speed | Instant | Delayed by polling interval |
| Efficiency | High | Wasteful when nothing changes |
| Complexity | Needs a receiving endpoint | Simpler to start |
Webhooks wait to be told. Polling keeps asking.
For analysts
When designing integrations, I'd ask which events must trigger action and how failures are retried. Missed webhooks can silently break business processes.
History & origin
Developer Jeff Lindsay coined the term 'webhook' in 2007, describing a simple pattern of web callbacks. Services such as PayPal had offered similar instant payment notifications earlier. Platforms including GitHub, Stripe, Shopify, and Slack adopted webhooks in the late 2000s and 2010s, and automation tools such as Zapier, founded in 2011, and IFTTT built businesses connecting apps through them. Standards efforts such as Standard Webhooks, launched in 2023, aimed to make signing and delivery more consistent. In my view, webhooks are the quiet plumbing behind much of modern business automation.