What is a Webhook?

Webhooks invert the usual client-pulls-data pattern: instead of an application repeatedly polling an API to check for changes, the source system pushes data the instant something happens. A payment processor firing a webhook when a charge succeeds, or a Git host firing one when code is pushed, are canonical examples. The receiving endpoint must respond quickly, typically within a few seconds, or the sender will consider the delivery failed and may retry with exponential backoff. Because webhooks arrive unauthenticated by default, most production integrations require verifying a signature header against a shared secret before trusting the payload — otherwise anyone who guesses the URL could inject fake events. Webhook consumers also need to be idempotent, since most providers guarantee at-least-once delivery and the same event can arrive twice during a retry.