What is a Webhook
A webhook is a mechanism where service A issues an HTTP POST to your URL when something happens. Opposite of polling: instead of "you ask every N seconds for updates" — "the service notifies you". Typical use-cases: payments (Stripe/YooKassa webhook → /payment/completed), CI/CD (GitHub push → Jenkins), monitoring (Enterno → your webhook when a site goes down).
Below: details, example, related terms, FAQ.
Details
- Receiver — a public URL accepting POST with JSON
- HMAC signature header (X-Signature-256) — forgery protection
- Replay protection: timestamp + nonce in payload
- Retry with exponential backoff — receivers are not always available
- Idempotency: receiver must tolerate seeing the same webhook 2+ times
Example
POST /webhook HTTP/1.1
X-Signature-256: sha256=abc...
Content-Type: application/json
{"event":"payment.succeeded","id":"pi_123"}Related Terms
Learn more
Frequently Asked Questions
Webhook or polling?
Webhook = near-realtime + less load on both sides. Polling = simpler for tests + works through firewalls (outgoing only). For production choose webhook.
How do I verify a webhook is from that service?
Check the HMAC signature with a shared secret. Stripe/YooKassa document the exact algorithm (usually HMAC-SHA256).
What if the receiver is down?
The service should retry 3-5 times with exponential backoff. After final fail — store in a dead-letter queue.