Short answer: an API is something your application calls when it wants data or wants an action performed. A webhook is an HTTP request a service sends to your application when an event occurs. Polling an API repeatedly asks, “Has it happened yet?” A webhook lets the service call you once it happens.
They are not competing technologies. Most reliable integrations use both: an API for commands and current state, and webhooks for timely event notifications.
API and webhook: the difference in one table
| Question | API | Webhook |
|---|---|---|
| Who starts the request? | Your client application | The provider, after an event |
| Pattern | Pull: request and response | Push: event delivery |
| Timing | On demand or on a schedule | Usually near real time after a subscribed event |
| Typical needs | HTTP client, credentials and rate-limit handling | Reachable endpoint, authentication, validation, retries and idempotency |
| Best fit | Read or change a resource when your application decides | React to a provider-side event |
| Recovery | Request the current state again | Reconcile by querying the API if a delivery is late or missing |
Both normally use ordinary HTTP. Your program sends an HTTP request and receives a response; with a webhook, the provider’s system acts as the HTTP client and your endpoint acts as the server.
What an API does
Client-initiated requests
When your application calls an API, it chooses the method, URL, parameters and time. A payment service might expose an endpoint to create a payment, retrieve a payment, or cancel one. The response normally contains the result, an error, or the current representation of a resource.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
Polling is still an API use
If an operation is asynchronous, you can poll its status endpoint: make a request, wait, and ask again. Polling is straightforward, but frequent checks consume request quota and server resources even when nothing changed. GitHub describes webhooks as a way to reduce that polling effort and scale better when many resources are monitored.
Use APIs for authoritative state
An API is the right tool when a user clicks “refresh,” when a job needs a resource only once, or when you must create or modify data. It is also the recovery path after a webhook: fetch the provider’s current state instead of assuming that an old event payload is still complete.
What a webhook does
Provider-initiated event delivery
You register an HTTPS endpoint and subscribe to event types. When a matching event occurs, the provider sends an HTTP request containing an event identifier, type, timestamp and data. Your endpoint acknowledges it, validates that it really came from the provider, and queues the work.
Near real-time, not an absolute guarantee
Webhooks avoid scheduled polling and commonly arrive soon after an event, but delivery can be delayed, duplicated or fail temporarily. Treat the provider’s documented retry behavior as the contract; do not promise a universal latency or delivery guarantee.
Security and idempotency are mandatory
- Use HTTPS and authenticate the endpoint. Providers commonly send a signature header; verify it with the provider’s official library or algorithm before trusting the body.
- Record each event ID and make processing idempotent. If the same delivery arrives twice, the second attempt must not charge a card or create a duplicate order.
- Return a fast 2xx response after durable validation and queueing. Do slow work in a worker so a timeout does not trigger unnecessary retries.
- Log the event ID, type, received time and processing result, but redact secrets and personal data.
Real-world example: an online store with Stripe
Step 1: create the payment with the API
When a shopper checks out, the store calls Stripe’s API to create or manage the payment. This is a deliberate command initiated by the store. The immediate response may say that the payment was created, requires customer action, or is still processing.
Step 2: receive the resulting event
Stripe then records state changes and sends an event to the store’s configured webhook endpoint. The endpoint verifies the signature, accepts the event, and updates the order. Stripe’s documented handler pattern uses signature verification with constructEvent(); never treat an unverified request body as proof of payment.
Rank #2
- Used Book in Good Condition
Step 3: reconcile when necessary
If the endpoint was unavailable, the worker crashed, or an event appears out of order, the store retrieves the payment through Stripe’s API and compares the authoritative state with its order record. The webhook tells the store when to look; the API supplies a deliberate read or write.
Another example: GitHub push to build
A deployment service subscribes to a repository’s push webhook. GitHub sends the commit and repository details as soon as a push event occurs, so the service can start a build without asking about every repository every few seconds. If the build system later needs the current issue, commit, branch or repository configuration, it calls the GitHub REST API on demand. GitHub recommends webhooks for ongoing event monitoring and API calls when information is needed once or intermittently.
Recommended Free Tools
How to choose between polling and a webhook
Choose an API request when
- A user or job needs data now.
- You must create, update or delete a resource.
- The provider offers no webhook for the event.
- You need a one-time or infrequent lookup.
Choose a webhook when
- You need to react whenever a provider-side event occurs.
- Polling would repeatedly ask about many resources.
- The provider documents event subscriptions and retries.
- Near-real-time notification matters more than a scheduled batch.
Use both when
Use the API to issue a command, the webhook to learn that processing changed, and the API again to retrieve or reconcile the final state. This hybrid pattern handles asynchronous work without sacrificing an authoritative source of truth.
A minimal, safe webhook receiver
The following Python example demonstrates the shape of a receiver. The signature format is illustrative; replace the verification function with your provider’s documented method and secret handling.
- Expose an HTTPS POST route that accepts the provider’s content type.
- Read the raw request body before JSON parsing, because signature schemes usually sign exact bytes.
- Verify the signature and reject failures with a non-success response.
- Check the event ID against a durable store, enqueue new work, then return 2xx.
from flask import Flask, request, abort
import hmac, hashlib, os, json
app = Flask(__name__)
SECRET = os.environ["WEBHOOK_SECRET"].encode()
seen = set() # use a database in production
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11def valid_signature(raw, supplied):
expected = hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
return hmac.compare_digest(expected, supplied or "")
@app.post("/webhooks/provider")
def receive():
raw = request.get_data()
if not valid_signature(raw, request.headers.get("X-Signature")):
abort(401)
event = request.get_json()
event_id = event.get("id")
if not event_id:
abort(400)
if event_id not in seen:
seen.add(event_id)
# enqueue(event) and process it in a worker
return ("", 204)
In production, replace the in-memory set with a transactional database table, enforce a timestamp tolerance if the provider supports it, and separate acknowledgement from business processing.
Retries, duplicates and missed events
Design for at-least-once delivery
Assume a valid event can arrive more than once. Put a unique constraint on the provider’s event ID, and make each business operation safe to retry. For example, update an order to “paid” only if it is not already paid.
Handle ordering explicitly
Events can arrive out of order. Store provider timestamps or version numbers when available, and ignore an older update that would overwrite newer state. If ordering is unclear, fetch the resource through the API before applying a destructive change.
Recover with reconciliation
Run a periodic reconciliation job that lists or retrieves current resources through the API and compares them with your database. This catches an endpoint outage, a permanently rejected delivery, or an event your consumer failed to process.
Operational checklist
- Register only the event types you need.
- Keep webhook secrets outside source control and rotate them according to the provider’s procedure.
- Allow inbound traffic only to the route you need, while permitting provider IP changes if the provider documents them.
- Set request and worker timeouts; never leave a connection open while doing lengthy work.
- Monitor response codes, queue depth, retry counts and age of the oldest unprocessed event.
- Provide a replay or dead-letter workflow that does not bypass signature verification.
- Use API rate-limit headers and exponential backoff for recovery calls.
Common failure modes and fixes
“The provider says delivery timed out”
Return a response only after durable validation and queueing. Move email, fulfillment and other slow work to a worker, and confirm your reverse proxy timeout exceeds the provider’s normal request window.
“Every event is processed twice”
Retries usually mean the first response was lost or too slow. Persist the event ID with a unique constraint before processing and make the handler idempotent.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems“Signature verification fails”
Verify the raw body, not a re-serialized JSON object; use the exact secret and header documented by the provider; and account for any required timestamp tolerance.
“The webhook says paid, but the order is wrong”
Do not trust a partial payload as your entire database record. Retrieve the current payment or order through the API, then apply a state transition that checks the existing order status.
“Polling hits rate limits”
Replace tight loops with the provider’s webhook subscription where available. For unavoidable polling, use exponential backoff, conditional requests and a schedule appropriate to the business need.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Performance, reliability and cost considerations
Webhooks usually reduce unnecessary requests because the provider sends only subscribed events. They add endpoint operations, queueing, signature verification and replay handling. APIs are simpler for isolated actions but can consume quota when polled frequently. Neither pattern has a universal latency or reliability number: measure your provider’s documented behavior and your own queue and processing times.
Best Value
Or skip the browser setup
If you need an automated screenshot of a page while testing an API or webhook workflow, ScreenshotNeo provides a single HTTP call instead of maintaining browser infrastructure. Before capture it accepts cookie or consent banners and removes more than 60 known consent platforms, newsletter popups and chat widgets; each step can be disabled. Bot checks, CAPTCHAs, blank pages, timeouts, failed loads and cache hits are not billed, and response headers identify the page verdict and billing result. It also offers an MCP server for AI agents, with take_screenshot, get_page_info and capture_pdf tools.
cURL:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp
Python:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)
Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);
Free tools Windows power users keep installed
One-click scans. No signup required.
See the complete option list and response details in the ScreenshotNeo documentation. The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000. Sign up free.
Frequently Asked Questions
Can a webhook call an API?
Yes. A webhook handler can validate an event and then call the provider’s API to retrieve complete or current resource data before updating your system.
Is polling ever preferable?
Yes. Polling can be appropriate for a one-time lookup, intermittent checks, providers without webhooks, or environments that cannot expose a reachable HTTPS endpoint.
Does receiving a webhook mean the operation succeeded?
Only if the event type and status indicate success and the signature is valid. For important state changes, retrieve the resource through the provider’s API when the payload is incomplete or ambiguous.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
