> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# What is a Webhook
> Explains webhooks versus polling, how webhooks work, security, retries, and implementation best practices for real time event notifications between applications.
How can one application learn about events that happen inside another application as soon as they occur?
A common scenario is handling a payment: you pay via a payment provider (for example Stripe) and your application needs to know the moment that payment is confirmed. There are two main approaches to solve this: polling and webhooks.
## Polling: the obvious but inefficient approach
With polling, your app repeatedly asks the other service, “Has the payment completed yet?” at a fixed interval (every few seconds or minutes).
This works, but it wastes bandwidth and server resources and introduces latency between the actual event and when your app learns about it.
## Webhooks: flip the direction of communication
A webhook reverses the flow: instead of your app asking, the other service calls your application when the event happens. You give the external service a publicly reachable callback URL on your server (for example `https://xyz.com/payment-done`). When the payment settles, the payment provider sends an HTTP request to that URL.
A webhook is a standard HTTP request. Typical payload example:
```http theme={null}
POST /payment-done HTTP/1.1
Host: xyz.com
Content-Type: application/json
{
"event": "payment_succeeded",
"order": 1234,
"amount": 40
}
```
Your endpoint should acknowledge the delivery quickly by returning an HTTP 200 OK (or another success status depending on the provider):
```http theme={null}
HTTP/1.1 200 OK
Content-Type: text/plain
OK
```
Most webhook providers implement retry policies: if your server is down or returns an error, they will retry delivery a number of times. Retry specifics vary by provider, so review the provider documentation.
Your webhook endpoint must be reachable from the public internet. During development you can expose a local server using a tunneling tool (for example, [`ngrok`](https://ngrok.com)) so the provider can reach your callback URL.
## Securing webhooks
Because the endpoint is public, anyone can try to send forged requests. Providers mitigate this by signing webhook requests using a shared secret. Your server should verify the signature before processing the payload.
A common pattern is an HMAC signature included in a header (for example `X-Webhook-Signature`), computed over the raw request body using a shared secret and a secure hash function (such as SHA-256). Example verification in Python:
```python theme={null}
import hmac
import hashlib
payload = b'{"event":"payment_succeeded","order":1234,"amount":40}'
secret = b'my_signing_secret'
sig_header = "sha256=..." # value from the X-Webhook-Signature header
expected = hmac.new(secret, payload, hashlib.sha256).hexdigest()
# Compare using constant-time comparison
if hmac.compare_digest(sig_header.split("=", 1)[1], expected):
# Process the webhook
print("Valid signature")
else:
# Reject the webhook
print("Invalid signature")
```
Additional security best practices:
* Only accept requests over HTTPS.
* Validate the payload schema and required fields before processing.
* Log received events and verification outcomes for auditing and debugging.
* Optionally implement IP allowlisting if the provider publishes their sending IP ranges.
## Polling vs Webhooks — quick comparison
| Approach | When to use | Pros | Cons |
| -------- | ------------------------------------------: | ------------------------------------------------- | -------------------------------------------------------- |
| Polling | Simple integrations, sporadic events | Easy to implement, works without public endpoints | Inefficient, higher latency, scales poorly |
| Webhooks | Real-time notifications, high volume events | Low latency, efficient, event-driven | Requires public endpoint, must handle security & retries |
## Examples and references
Popular services that use webhooks:
* GitHub triggers CI/CD with webhooks: [https://docs.github.com/en/developers/webhooks-and-events/webhooks](https://docs.github.com/en/developers/webhooks-and-events/webhooks)
* Slack uses webhooks to post messages into channels: [https://api.slack.com/messaging/webhooks](https://api.slack.com/messaging/webhooks)
When designing integrations, choose webhooks for near-instant notifications and efficiency, and reserve polling only for simple or constrained scenarios.