What is a Webhook? How it works in practice

A webhook is the mechanism by which one system automatically notifies another when an event happens, in real time. Unlike a traditional API (where you have to ask), the webhook pushes information as soon as it exists. It is the backbone of real-time integrations: new comment, completed sale, confirmed payment.

What is a Webhook?

Webhook (also called "HTTP callback") is how one system sends information to another automatically as soon as an event happens. Think of it like an automated SMS: you don't have to keep asking, the system tells you when something changes.

It's the opposite of the traditional API approach:

API "pulls" (polling): you ask every X minutes "anything new?"
Webhook "pushes": the system notifies the instant it happens

How it works

You register a URL (endpoint) in the source system
The source system records: "when event X happens, send POST to this URL"
Event happens (e.g., someone finishes a purchase)
The source system automatically sends a POST with JSON payload to your URL
Your system receives and processes it

Practical example

E-commerce connected to email automation via webhook:

You register the URL https://yourdomain.com/webhooks/purchase in Shopify. When someone buys, Shopify sends:

POST https://yourdomain.com/webhooks/purchase
Content-Type: application/json

{
  "order_id": "5894371",
  "customer_email": "ana@example.com",
  "total": 289.90,
  "items": [
    { "name": "Facial Moisturizer", "qty": 1 }
  ],
  "created_at": "2026-06-05T14:32:01Z"
}

Your automation receives it and:

Adds Ana to the "Recent buyers" list
Triggers a thank-you email in 5 minutes
Schedules a cross-sell email in 14 days
Sends the Purchase event to the Pixel via Conversions API

Common use cases

E-commerce: purchase → email automation, CRM, BI
Payment: Stripe/Pagar.me → confirms and releases service
Social media: new comment → customer service team
Conversions API: event → Meta Ads
WhatsApp Business API: incoming message → chatbot
Github/Gitlab: push → automated deploy

Best practices

Validate the signature (HMAC) to confirm the webhook came from the real source
Respond 200 OK quickly (within 5 seconds)
Process in an async queue so it doesn't block
Implement idempotency (same event may arrive twice)
Log everything for debugging
Public HTTPS endpoint

Common mistakes

Not validating the signature — anyone could send fake requests
Responding too slowly and the source retrying many times
Not handling duplicates (same payment processed twice)
HTTP endpoint (no SSL) — modern sources refuse
Not monitoring failures (webhook went down and you discover 3 days later)

Webhook