{"head":{"title":"What Is a Webhook? Definition and Example | OceanLab","description":"A webhook is an HTTP call one system sends to another when something happens. How webhooks work, how to receive them safely, an example and mistakes.","canonical":"https://oceanlab.in/glossary/webhook"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"webhook","path":"/glossary/webhook"}],"slug":"webhook","term":"Webhook","aka":["HTTP callback"],"category":"System design","short":"An HTTP request one system sends to a URL you choose as soon as an event happens, so you do not have to keep asking.","body":[["Instead of your app checking every minute whether a payment has cleared, the payment provider calls your webhook URL the moment it does, with the details in the request body. Your server reads it, acts on it and replies with a success code."],["Webhooks are a simple form of ",{"href":"/glossary/event-driven-architecture","text":"event-driven architecture"}," across company lines. Most providers sign each call so you can check it is genuine, and retry when your server does not answer."]],"why":["Webhooks are how payments, e-signatures, shipping updates and many other integrations report back. They are faster and cheaper than polling. Because providers retry, the same event can arrive more than once, so handlers must be built to cope."],"example":["A subscription app listens for payment succeeded and payment failed webhooks from its payment provider. On success it extends the plan; on failure it emails the customer. Each event ID is stored, so a retried event does not extend the plan twice."],"inBuild":["We verify the signature, store the raw event, reply fast and do the real work in a background job from a ",{"href":"/glossary/message-queue","text":"message queue"},". Handlers are made ",{"href":"/glossary/idempotency","text":"idempotent"}," by event ID, and there is a screen or script to replay failed events."],"mistakes":[["Skipping signature checks, so anyone who finds the URL can fake events."],["Doing slow work before replying, which causes timeouts and duplicate retries."],["Assuming events arrive once and in order. They can do neither."]],"related":[{"href":"/glossary/idempotency","label":"Idempotency","detail":"The property of an operation that has the same effect whether it runs once or several times, so it is safe to retry."},{"href":"/glossary/event-driven-architecture","label":"Event-driven architecture","detail":"A way of designing software where parts of the system publish events about what happened, and other parts react to them on their own."},{"href":"/glossary/message-queue","label":"Message queue","detail":"A buffer that holds messages, such as tasks or events, until a worker is ready to process them, so the sender does not have to wait."},{"href":"/glossary/api-gateway","label":"API gateway","detail":"A single entry point that sits in front of a system's APIs and handles routing, auth and limits for every request."},{"href":"/glossary/oauth","label":"OAuth 2.0","detail":"A standard that lets an app get limited access to a user's account on another service, without ever seeing their password."}],"tools":[{"href":"/tools/payment-processing-fee-calculator","label":"Payment processing fee calculator","detail":"Free tool"}],"links":[{"href":"/software/payments","label":"Software for payments","detail":"Payment systems and the compliance work they bring."},{"href":"/pricing/categories/payments","label":"Payments pricing","detail":"Payment provider fees, with sources."}],"sources":[],"legal":false,"updatedAt":"2026-10-25"}