Webhook
A webhook is an automatic notification one system sends to another as soon as a certain event occurs — such as “new order” or “payment received”.
Instead of one system constantly asking whether there is anything new, the other system reports on its own. This makes processes faster and saves resources.
Webhooks are a central building block of many automations: a payment provider reports a successful payment, the shop then creates invoice and shipping label, the CRM is updated.
Because webhooks are called from outside, they must be secured: incoming messages should be verified for authenticity and errors handled so that no events are lost.
What to look out for
- Verify incoming webhooks for authenticity, e.g. via signatures.
- Log failed deliveries and reprocess them.
- Detect duplicate deliveries so nothing is triggered twice.
- Keep webhook addresses secret and offer them only over HTTPS.
- Monitor whether expected events actually arrive.
Common mistakes
- Webhooks are processed unverified — anyone could fake orders.
- An outage of the receiver leads to lost events.
- A payment is booked twice because the message arrived twice.
Frequently asked questions
With an API, one system actively requests or sends data. A webhook is the reverse: the other system reports on its own as soon as something happens.
Not necessarily for simple cases — automation tools such as n8n or Make can receive webhooks. For business-critical processes, a secured implementation pays off.