An event webhook is an HTTP callback that sends data to your application when a subscribed event occurs. Instead of repeatedly asking an API whether anything has changed, your application gives a provider an endpoint and selects the events it wants to receive. The provider then sends an HTTP request—usually a POST—with event information. That makes webhooks useful for workflows such as starting a build after a code push or syncing an order into another system.
What is an event webhook?
An event webhook is a subscription-based HTTP callback: a provider sends a request to a URL you register when a selected event happens. GitHub describes webhooks as a way to receive data as it happens rather than poll an API repeatedly. Its documentation defines them as a way to subscribe to events in a software system and automatically receive a delivery of data whenever those events occur: GitHub Docs: About webhooks.
The term is widely used, but it does not have one universal formal definition. The CloudEvents HTTP Web Hooks specification notes that despite the pattern’s widespread use, there is no formal definition for webhooks: CloudEvents HTTP Web Hooks specification.
In practice, a webhook is a contract between a provider and a receiving application: the provider defines which events it can send, how it authenticates and retries deliveries, and what the payload looks like; the receiver must accept and safely process those deliveries.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
How does a webhook work?
- Register an endpoint. Configure a publicly reachable URL on your server and subscribe to specific event types or topics.
- An event occurs. For example, a repository receives a push or a store records an order.
- The provider sends a delivery. The provider makes an HTTP request, normally a POST, with event-specific data and delivery headers. The exact payload and headers depend on the provider: GitHub webhook events and payloads.
- Your endpoint verifies and acknowledges it. Check that the request is authentic and relevant, then return a successful 2XX response promptly.
- Your application processes it safely. Record the delivery identifier, avoid applying the same side effect twice, and queue work that cannot finish within the provider’s acknowledgement window.
GitHub recommends responding within 10 seconds and suggests queueing work that takes longer. Treat that as GitHub’s documented guidance, not as a universal deadline: providers set their own delivery requirements. See GitHub’s webhook best practices.
What are webhooks used for?
- Software development: A push or pull-request event can start CI or notify a team chat.
- Deployments: A deployment event can trigger a rollout workflow.
- Commerce operations: A Shopify order or product event can synchronize accounting, warehousing, or a data warehouse.
- App lifecycle tasks: An uninstall event can trigger removal of customer data from an external system.
These examples reflect use cases described by GitHub and Shopify. A webhook is a notification and delivery mechanism; your application still decides what business action to take.
What does a webhook payload contain?
There is no universal webhook payload format. Each provider defines its event schema, headers, identifiers, and limits. GitHub documents event-specific payload properties, sender information, delivery headers, and a 25 MB payload cap. That cap is GitHub-specific, not a general webhook limit. Refer to its event and payload reference before designing a receiver.
Rank #2
Shopify deliveries illustrate a different set of metadata: the topic, shop domain, API version, HMAC signature, webhook ID, trigger timestamp, and event ID appear in headers described in Shopify’s webhook documentation. Check the provider’s current schema and versioning rules rather than assuming fields from one service will exist in another.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Webhook versus polling
| Approach | How it works | Useful when | Trade-off |
|---|---|---|---|
| Webhook | The provider sends a request when a subscribed event occurs. | The provider exposes the events your application needs and you want updates without repeatedly checking. | You must operate a reachable endpoint and handle authentication, retries, duplicates, and downtime. |
| Polling | Your application asks an API at intervals whether anything has changed. | The provider has no suitable webhook, or you need a way to reconcile state or backfill missed changes. | Checks may return no new data, and updates are only discovered when the next check runs. |
The push-versus-poll distinction is described in GitHub’s overview. Reconciliation and backfill are practical implementation uses of polling: they help recover state after an outage or verify that the receiver has not missed a delivery. Neither method removes the need to handle operational failures.
How to secure a webhook endpoint
- Use HTTPS. Keep certificate verification enabled so requests are protected in transit and your client does not accept an untrusted connection.
- Verify the provider’s authentication mechanism. Use the configured secret or verify the provider’s signature over the request as its documentation specifies. Keep secrets out of URL query strings. Shopify, for example, documents an HMAC-SHA256 signature header; use its documented verification process rather than treating the header as an opaque token.
- Check event type and action. A valid request can still describe an event your handler should ignore. Dispatch only event types and actions your application expects.
- Validate the payload. Treat incoming data as untrusted input. Check required fields and expected types before using it in business logic.
- Limit subscriptions. Subscribe only to event types your application handles. Fewer irrelevant deliveries reduce unnecessary processing and mistakes.
- Protect secrets and access. Store webhook secrets in appropriate configuration or secret storage, restrict who can change endpoint settings, and rotate credentials using the provider’s supported process.
GitHub recommends HTTPS, secret validation, and checking event type and action; Shopify documents HMAC-SHA256 verification. Their precise headers and verification procedures differ, so follow the relevant provider guidance: GitHub best practices and Shopify webhooks.
How to handle retries, duplicates, and downtime
Webhook delivery is not the same as exactly-once processing. A provider may retry after a timeout or an unsuccessful response, and a delivery can be repeated. Your endpoint should be designed so that receiving the same event more than once does not repeat an irreversible action.
Acknowledge quickly, process asynchronously
Verify enough of the request to accept it, persist a receipt or enqueue the work, and return a 2XX response within the provider’s deadline. Do not keep the HTTP request open while running a long report, waiting on another service, or performing a slow series of writes. GitHub recommends a response within 10 seconds; other providers may specify a different deadline in their documentation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Deduplicate using provider identifiers
Record a stable delivery or event identifier and make the business operation idempotent: processing the same event again should not create a second payment, shipment, or other unintended side effect. GitHub documents the X-GitHub-Delivery header for detecting a replay. Shopify documents webhook and event identifiers for identification and deduplication. The identifier and its scope are provider-specific; use the provider’s guidance rather than assuming an ID from one service works the same way everywhere.
Rank #4
Plan for recovery
Monitor delivery failures, know how to redeliver missed events, and have a reconciliation path for restoring state after your service or the provider is unavailable. GitHub documents redelivery practices in its webhook best practices. A local queue protects work after your endpoint has accepted a request; it cannot recover a delivery that never reached the endpoint, so recovery procedures matter as well.
What to check when choosing or implementing a webhook
Webhook behavior differs between providers, even when both use HTTP POST requests. Before committing to an integration, compare the details that determine whether your receiver can operate reliably:
- Event coverage: Are the events and actions you need available?
- Payload and schema changes: Are fields documented, versioned, and compatible with your processing?
- Authentication: Is a shared secret, signature, or another verification method provided?
- Retry and redelivery: What triggers retries, how long are they attempted, and can you manually replay a delivery?
- Deduplication identifiers: Does each delivery or logical event have a stable ID?
- Acknowledgement deadline and payload limit: How quickly must you respond, and how large can a request be?
- Observability and recovery: Can you inspect failed deliveries and reconcile after downtime?
GitHub’s 10-second response recommendation and 25 MB payload cap are examples of provider-specific operational details, not industry-wide standards. Shopify’s inclusion of API-version metadata is another reason to account for version changes in your handler.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCommon webhook problems and fixes
- The provider reports a timeout: The handler may be doing too much before responding. Validate, persist or enqueue the event, acknowledge promptly, and move slower work to a background worker.
- The endpoint returns a non-2XX status: Inspect server logs and the provider’s delivery record for the actual response and error. Fix the underlying failure before triggering a redelivery; repeated sends may otherwise encounter the same problem.
- Signature verification fails: Confirm that you used the correct secret and the provider’s exact signing algorithm and verification procedure. Ensure your framework has not altered the raw request body if the signature is calculated over that body.
- An event is handled twice: Persist the provider’s delivery or event identifier and make the relevant operation idempotent. Do not rely on a request arriving only once.
- A valid delivery causes the wrong action: Check both the event type and any action field before dispatching business logic, then validate the expected payload schema.
- Events are missing after an outage: Use the provider’s delivery history and redelivery features where available, then reconcile your local state against the provider’s source of truth.
- The payload no longer matches assumptions: Check the provider’s documented schema and API-version policy. Version metadata in a delivery can help identify which format was sent.
Or skip the browser setup
For website screenshots, ScreenshotNeo offers a single HTTP request instead of setting up and maintaining a browser capture environment. It accepts the consent banner like a visitor and removes more than 60 known consent platforms, newsletter popups, and chat widgets before capture; those steps can be turned off. Bot checks and CAPTCHAs, blank pages, timeouts, failed loads, and cache hits cost nothing, with verdict and billing information in response headers. Its MCP server provides screenshot tools for AI agents, and the free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000. See ScreenshotNeo and its API documentation.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp
Sign up free for 1,000 screenshots a month, with no card required.
Frequently asked questions
Is a webhook the same as an API?
No. A webhook is a delivery pattern that uses HTTP requests to notify a receiver about events. The provider may also expose an API that your application calls to retrieve or change data.
Can a webhook send data to a local development machine?
A provider must be able to reach the registered endpoint. A machine available only on a private local network is not reachable by a public provider unless you arrange an appropriate public endpoint or development forwarding method.
Does a successful HTTP response prove that the business operation finished?
Not necessarily. A receiver may acknowledge after safely queuing the event, then complete the business work asynchronously. The acknowledgement means the delivery was accepted at that stage, not necessarily that every downstream action is complete.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
