Skip to main content
Mobius
Intermediate

What is a webhook

Also known as: web hook, HTTP callback, HTTP push API

Definition

A webhook is an automatic message one system sends to an address you gave it the moment something happens, like a payment. You stop asking, it tells you.

Why it matters

A webhook is how your systems react to a sale, a form or a message within seconds, without anyone checking by hand.

Common mistakes

Trusting a webhook without checking its signature, so anyone who finds the address can send a fake "payment succeeded".

Related terms

Worked exampleIllustration

A webhook slip: a paid online workshop sells a seat

Sent to

The notify address the business registered with its payment provider.

Event

Payment succeeded.

Expected reply

200 OK within seconds.

Carries

  • The order number
  • The payment result

Proof of sender

A signature or shared secret the receiver checks before it trusts the message.

Steps

  1. The customer pays on the payment page.

  2. The payment provider sends a webhook to the address the business registered: the event "payment succeeded", with the order number.

  3. The business's system checks the signature and replies 200 OK within seconds.

  4. It checks that this order number was not handled before, because the same event can arrive twice.

  5. It calls the invoicing platform's API to issue the invoice, and sends the WhatsApp confirmation with the Zoom link.

  6. If the server was down at step 3, the provider tries again later, and an alert on failed deliveries tells the team.

The webhook said "it happened", and the API calls did the work.

Illustration

Asking again and again, or being told once

Asking every 30 minutes: 21 questions today, 20 of them answered "nothing new", and the payment was noticed 23 minutes late. The webhook sent one message, at the moment of payment.Payment 11:07⁨Polling: asking "anything new?"⁩⁨+23 min⁩⁨Webhook: the provider tells you⁩200 OK08:0013:0018:00

Asking every 30 minutes: 21 questions today, 20 of them answered "nothing new", and the payment was noticed 23 minutes late. The webhook sent one message, at the moment of payment.

If your server is down when the webhook arrives, most providers try again later, so check that the same event is not handled twice.

One payment during a working day. The top lane checks for news on a timer, the bottom lane is a webhook that speaks only when something happens.

Definition

A webhook is an HTTP request, usually a POST, that a provider's system sends to a URL you registered whenever an event you subscribed to occurs. It has five parts: the endpoint (the URL you give the sender), the event (for example "payment succeeded"), the payload (the data, usually JSON), the fast reply your server must send (a 2xx status such as 200 OK), and a signature that proves who sent it. It runs in the reverse direction to an ordinary API call: with an API you ask, with a webhook the other system calls you. What it replaces is polling, asking the other system again and again whether anything is new. A webhook is normally part of the provider's API product, not its opposite. Jeff Lindsay coined the name in 2007, describing user defined callbacks made with HTTP POST.

Why it matters

It works like the text your bank sends the moment your card is charged, instead of you logging in to check. Israeli payment providers document it: Tranzila calls it a notify URL, which fires on Bit, card and standing order payments, and Grow (formerly Meshulam) sends a server to server callback to a notifyUrl. Meta's WhatsApp Business Platform delivers incoming messages and message status updates to your system by webhook. When you need a report or a list on demand, you ask the API instead, and when a sender offers no webhooks, polling is the fallback.

Directly related: API, Server, Cloud.

Improvement tips

  • Reply 200 OK at once and do the slow work afterwards, in a queue, so the sender does not time out and retry.
  • Check the signature on every incoming webhook before you act on it.
  • Store each event's id and skip any id you have already handled, so a repeated delivery never issues a second invoice or a second access link.
  • Set up an alert on failed deliveries, because a broken endpoint fails silently.

Common mistakes

  • Assuming each event arrives exactly once, and issuing a second invoice when it arrives twice.
  • Running slow work before replying, so the sender gives up waiting and sends the event again.
  • Having no alert on failed deliveries, so nobody notices when the endpoint stops working.
API vs Webhook

Related terms

TechnologyIntermediate

API

An API (application programming interface) is the agreed way one program asks another for data or an action and gets an answer, so your tools can work together.

TechnologyBeginner

Server

A server is a computer, or a program on one, that receives requests from other programs, such as a visitor's browser, processes them and sends back an answer.

TechnologyBeginner

Cloud

The cloud, or cloud computing, is renting a provider's servers, storage and software over the internet instead of running your own, paid monthly or by use.

Quick check

What does a webhook replace?

Choose an answer

Frequently asked questions

Do I need to understand webhooks before I start my business?
You do not need to write one, but you should know what it does: another system tells yours the moment something happens, such as a payment or a submitted form. That lets you plan automatic steps, like a welcome message right after a purchase, instead of someone checking by hand.
When does a webhook first become relevant for a new business?
When two of your tools have to react to each other, for example the payment page and the invoicing platform, or a sale and the course access. Without a webhook one system has to ask the other again and again whether anything is new, which is called polling, and it notices the event late.
What do webhooks cost to set up?
Most payment, invoicing and messaging platforms include webhooks in their service. Automation tools differ: some include webhooks on their free plan with a low cap, others only on paid plans, so check the plan before you build on it. A custom receiver takes developer hours, and the saving is the manual work it removes.
Should I use webhooks or the API for my workflows?
Usually both, in one flow. The webhook says "payment 123 succeeded", and your system then calls the API to fetch the details or issue the invoice. When you need a report or a list on demand, you ask the API. When the sender offers no webhooks, polling is the fallback.
Why do webhooks matter for a business already running?
They let a customer get the access link or the order confirmation within seconds when delivery succeeds, with retries when it does not. They also remove the manual step of someone watching the payment screen and copying data between systems.
What goes wrong when a webhook fails to deliver?
The event is missed: an order stays unpaid in your system, an account is not created or the customer never gets access. Providers usually retry for a while, but a broken endpoint fails silently unless someone is watching. Keep the provider's delivery log in view and set an alert on failures.
How do I protect my webhook address from fake messages?
Your developer checks the signature that comes with each webhook, which proves it came from your provider, and rejects anything without a valid one. The address itself is no secret, so the signature check is what stops a fake "payment succeeded".
How do I catch webhook errors early?
Most platforms show a delivery log with each attempt and its result. Set an alert on failed deliveries, and check the log after any change to your site or server.
What does webhook actually mean in plain words?
One system tells another "this just happened" by sending a short message to an address it was given in advance. You set it up once, and after that the notices arrive on their own, like a doorbell instead of checking the door every few minutes.
Are webhooks difficult or risky to configure?
In automation tools you set them up from menus, and in payment platforms you paste your address into the settings. The risks are a receiver that does not check the signature and an endpoint that breaks without anyone noticing, so an alert on failures belongs in the setup from day one.
Do I need a developer to set up webhooks for my store?
For simple links between common apps, an automation tool can receive the webhook and pass the data on without code. For your own system, such as granting access or updating a customer record, a developer should build the receiver so it checks the signature and handles repeats.
How does a webhook differ from an API?
Direction. With an API your system asks and gets an answer. With a webhook the other system calls your address when an event happens. A webhook is itself an HTTP request and usually part of the provider's API product, so the two work together rather than against each other.

Sources: GitHub Docs, About webhooks (docs.github.com), read 23 September 2026, Tranzila developer docs, notify URL for Bit, card and standing order payments (docs.tranzila.com), read 23 September 2026, Grow (formerly Meshulam) developer docs, Webhooks and the payment request callback (grow-il.readme.io), read 23 September 2026, Meta for Developers, WhatsApp Business Platform, Webhooks overview (developers.facebook.com), read 23 September 2026, Zapier, Pricing, plan feature table (zapier.com/pricing), read 23 September 2026, Make Community, Does the free plan include the use of webhooks, moderator answer (community.make.com), read 23 September 2026, Wikipedia, Webhook, on Jeff Lindsay's 2007 coinage, read 23 September 2026

Last reviewed: 2026-09-23

I have worked with

What Clients Say

From different fields, at different stages of business

Dan Manto

Eclipse Capital

Real Estate Investment and Finance, USA

Arty McLabin

GameReady

Game Development Education and Outsourcing, International

Anna, Beautician

Anna

Beautician

After I finished a cosmetology course at a leading company, I was confused. I didn't know how to open a business, what to sell from home, or how to bring in clients. Since I reached out to Mobius, everything has changed. We built an organized plan with clear steps and no unnecessary risks. Today I see results, and I'm growing and developing every month.

Mark, Massage therapist, Gan Yavne

Mark

Massage therapist, Gan Yavne

When I finished a massage course, I imagined a different world. I found out it's a hard field, and financial stability isn't easy to find. When I came to Mobius, something changed. We started an organized process and built a business plan. Without Mobius? I probably would have given up. Today I believe in myself and in my own path.

Tech decisions bigger than your team?

Alex helps Israeli businesses choose technology that fits the business, not the hype. The first call is free.

+972 055-248-6151. Better on WhatsApp: I am in meetings most of the day and answer as soon as I am free.