Webhook
Also called HTTP callback.
An HTTP request one system sends to a URL you choose as soon as an event happens, so you do not have to keep asking.
Last updated
What it is.
Instead of your app checking every minute whether a payment has cleared, the payment provider calls your webhook URL the moment it does, with the details in the request body. Your server reads it, acts on it and replies with a success code.
Webhooks are a simple form of event-driven architecture across company lines. Most providers sign each call so you can check it is genuine, and retry when your server does not answer.
Why it matters
Webhooks are how payments, e-signatures, shipping updates and many other integrations report back. They are faster and cheaper than polling. Because providers retry, the same event can arrive more than once, so handlers must be built to cope.
In a product build
We verify the signature, store the raw event, reply fast and do the real work in a background job from a message queue. Handlers are made idempotent by event ID, and there is a screen or script to replay failed events.
Common mistakes.
- 01
Skipping signature checks, so anyone who finds the URL can fake events.
- 02
Doing slow work before replying, which causes timeouts and duplicate retries.
- 03
Assuming events arrive once and in order. They can do neither.
Work it out with a tool.
Related terms.
- IdempotencyThe property of an operation that has the same effect whether it runs once or several times, so it is safe to retry.
- Event-driven architectureA way of designing software where parts of the system publish events about what happened, and other parts react to them on their own.
- Message queueA buffer that holds messages, such as tasks or events, until a worker is ready to process them, so the sender does not have to wait.
- API gatewayA single entry point that sits in front of a system's APIs and handles routing, auth and limits for every request.
- OAuth 2.0A standard that lets an app get limited access to a user's account on another service, without ever seeing their password.
Guides and pages
Browse the full glossary or read answers to common questions.
