What is Webhook?
Also called HTTP callback, outbound webhook, reverse API.
A webhook is an HTTP request that one system sends to a URL you supply whenever a chosen event happens, so you learn about it immediately instead of repeatedly asking. It inverts the usual direction of an API call, since the provider becomes the caller and your endpoint becomes the server. Whether it is called inbound or outbound depends on which side you stand on.
Setup has three parts: you register a URL with the provider, you choose which events to receive, and the provider sends an HTTP POST with a body describing each event as it occurs. Your endpoint should acknowledge quickly with a success status and do the real work afterwards, because most providers treat a slow or failing response as a delivery failure and retry it.
Polling wastes requests and adds delay, since checking once a minute means up to a minute of lag and thousands of empty checks a day. Webhooks reverse that, so events arrive in roughly the time one request takes. For agent systems they are the standard way to trigger work from outside, such as starting a workflow when a form is submitted or a payment settles.
Delivery is at least once rather than exactly once, so the same event will eventually arrive twice and handlers must be idempotent. Ordering is not guaranteed either. Endpoints are publicly reachable by definition, so signature verification is mandatory, because without it anyone who learns the URL can forge events. Treating an unverified payload as authoritative is a real and common vulnerability.
Because retries stop after a while, an endpoint that stays down long enough loses events permanently, so a periodic reconciliation pass against the provider's API is a sensible backstop for anything that matters. During development, a public tunnel or a hosted request inspector is the usual way to receive callbacks on a local machine.
Key points
- The provider sends an HTTP POST to your URL when an event occurs.
- Replaces polling, cutting both latency and wasted requests.
- Delivery is at least once and unordered, so handlers must be idempotent.
- Always verify the signature before trusting a payload.
- Reconcile periodically, since provider retries eventually give up.
In practice
A subscription service is told to notify an endpoint at your domain whenever an invoice is paid. When a customer's card clears, it posts a body containing the invoice identifier along with a signature header. The endpoint checks the signature, records the identifier, returns a success status within a fraction of a second, and queues the account upgrade for a background worker. A repeat of the same identifier is ignored.