What is a Webhook

How can one application learn about events that happen inside another application as soon as they occur? A common scenario is handling a payment: you pay via a payment provider (for example Stripe) and your application needs to know the moment that payment is confirmed. There are two main approaches to solve this: polling and webhooks.

The image illustrates a concept of communication between two applications: "Your App" and a "Payment Co." app, questioning how one app finds out about actions in the other.

Polling: the obvious but inefficient approach

With polling, your app repeatedly asks the other service, “Has the payment completed yet?” at a fixed interval (every few seconds or minutes). This works, but it wastes bandwidth and server resources and introduces latency between the actual event and when your app learns about it.

The image illustrates a polling process between "Your App" and a "Payment Co." system, questioning whether a payment is completed.

Webhooks: flip the direction of communication

A webhook reverses the flow: instead of your app asking, the other service calls your application when the event happens. You give the external service a publicly reachable callback URL on your server (for example https://xyz.com/payment-done). When the payment settles, the payment provider sends an HTTP request to that URL.

The image illustrates a webhook connection between "Your App" and "Payment Co," with the text, "They call you the moment it happens."

A webhook is a standard HTTP request. Typical payload example:

POST /payment-done HTTP/1.1
Host: xyz.com
Content-Type: application/json

{
  "event": "payment_succeeded",
  "order": 1234,
  "amount": 40
}

Your endpoint should acknowledge the delivery quickly by returning an HTTP 200 OK (or another success status depending on the provider):

HTTP/1.1 200 OK
Content-Type: text/plain

OK

Most webhook providers implement retry policies: if your server is down or returns an error, they will retry delivery a number of times. Retry specifics vary by provider, so review the provider documentation.

Your webhook endpoint must be reachable from the public internet. During development you can expose a local server using a tunneling tool (for example, ngrok) so the provider can reach your callback URL.

Securing webhooks

Because the endpoint is public, anyone can try to send forged requests. Providers mitigate this by signing webhook requests using a shared secret. Your server should verify the signature before processing the payload. A common pattern is an HMAC signature included in a header (for example X-Webhook-Signature), computed over the raw request body using a shared secret and a secure hash function (such as SHA-256). Example verification in Python:

import hmac
import hashlib

payload = b'{"event":"payment_succeeded","order":1234,"amount":40}'
secret = b'my_signing_secret'
sig_header = "sha256=..."  # value from the X-Webhook-Signature header

expected = hmac.new(secret, payload, hashlib.sha256).hexdigest()
# Compare using constant-time comparison
if hmac.compare_digest(sig_header.split("=", 1)[1], expected):
    # Process the webhook
    print("Valid signature")
else:
    # Reject the webhook
    print("Invalid signature")

Additional security best practices:

Only accept requests over HTTPS.
Validate the payload schema and required fields before processing.
Log received events and verification outcomes for auditing and debugging.
Optionally implement IP allowlisting if the provider publishes their sending IP ranges.

Polling vs Webhooks — quick comparison

Approach	When to use	Pros	Cons
Polling	Simple integrations, sporadic events	Easy to implement, works without public endpoints	Inefficient, higher latency, scales poorly
Webhooks	Real-time notifications, high volume events	Low latency, efficient, event-driven	Requires public endpoint, must handle security & retries

Examples and references

Popular services that use webhooks:

GitHub triggers CI/CD with webhooks: https://docs.github.com/en/developers/webhooks-and-events/webhooks
Slack uses webhooks to post messages into channels: https://api.slack.com/messaging/webhooks

When designing integrations, choose webhooks for near-instant notifications and efficiency, and reserve polling only for simple or constrained scenarios.

Docker

Kubernetes

CI/CD & DevOps

Security

Networking

Advanced Concepts

Interview Setup

System Design

Polling: the obvious but inefficient approach

Webhooks: flip the direction of communication

Securing webhooks

Polling vs Webhooks — quick comparison

Examples and references

Watch Video

​Polling: the obvious but inefficient approach

​Webhooks: flip the direction of communication

​Securing webhooks

​Polling vs Webhooks — quick comparison

​Examples and references

Watch Video

Polling: the obvious but inefficient approach

Webhooks: flip the direction of communication

Securing webhooks

Polling vs Webhooks — quick comparison

Examples and references