What is webhook?
Quick definition
An HTTP callback mechanism that sends real-time data to a specified URL when specific events occur, enabling asynchronous integration between systems.
A webhook is an automated HTTP POST request triggered by an event in one application to notify another application about that event. Rather than continuously polling an API for changes, webhooks provide a push-based model where the source system actively delivers data to a destination URL when something happens. This approach is more efficient and reduces latency, making webhooks essential for real-time integrations between services.
Webhooks are commonly used in CI/CD pipelines, payment processing, task management systems, and API integrations. When an event occurs—such as a code push, payment completion, or task update—the originating service automatically sends a payload containing relevant event data to a pre-configured endpoint. The receiving application can then process this data, trigger workflows, or update its own state accordingly.
Implementing webhooks requires securing the endpoint with authentication mechanisms (signatures, API keys, or tokens), handling retries for failed deliveries, and validating incoming payloads to prevent injection attacks. For AI agents and automation systems, webhooks enable seamless event-driven architectures where external systems can trigger agent workflows without explicit polling.
Example
How it shows up in practice
When a task is moved to 'Done' in a project management tool, a webhook sends a POST request to https://api.example.com/webhooks/task-completed with JSON payload containing task ID, status, and timestamp.
Frequently asked questions
How is a webhook different from API polling?
Webhooks use a push model where the server sends data when events occur, while polling requires the client to repeatedly request data. Webhooks are more efficient and provide real-time updates with lower latency and reduced server load.
What makes a webhook secure?
Webhooks are secured through HMAC signatures, API key authentication, bearer tokens, and HTTPS encryption. The receiving endpoint should validate signatures and verify the request origin before processing the payload.
How should I handle failed webhook deliveries?
Implement exponential backoff retry logic, store unprocessed webhooks in a queue, log all attempts, and provide a webhook management dashboard to manually retry or debug failed deliveries.
Can webhooks guarantee delivery?
No. Network failures, timeouts, or server issues can prevent delivery. Design idempotent webhook handlers that safely process duplicate deliveries and implement acknowledgment mechanisms to confirm receipt.