Free tools Windows power users keep installed
One-click scans. No signup required.
A webhook is a way for one service to notify another when a chosen event happens: the service sends an HTTP request to a URL you configure, rather than waiting for your application to ask whether anything changed. This push-based approach can deliver near-real-time updates and avoid repeated API checks, but a reliable webhook receiver must verify requests, handle duplicate deliveries, and recover from failures.
How does a webhook work?
- Choose events and a destination. In the provider’s system, subscribe to the events your application needs and register a URL that can receive HTTP requests.
- The provider detects an event. A matching action occurs—for example, a code push, pull-request review, or order placement.
- The provider sends event data. It makes an HTTP request to your URL with a payload describing the event.
- Your receiver validates and handles it. Check the request’s signature, inspect its event type and action, then process the event or place work on a queue.
- Your server acknowledges delivery. Return a success response promptly. If the work takes longer, acknowledge the request and let a background worker handle it.
For example, a code-hosting service can send a webhook after a push so a continuous-integration system starts a build. A pull-request review can trigger a message to a collaboration tool, an issue-tracker update, a deployment, or an audit log entry. Commerce webhooks can signal an order placement or product price change, or pass information to fulfillment, accounting, notifications, or a data warehouse. See GitHub’s overview of webhooks and Shopify’s webhook use cases.
Webhook vs. polling: which should you use?
| Consideration | Webhook | Polling |
|---|---|---|
| How updates arrive | The provider sends a request when a subscribed event occurs. | Your client repeatedly asks the API whether anything changed. |
| Timing | Can notify your receiver near the time of the event. | Updates are found on the next scheduled check; timing depends on the interval. |
| Request load | Can avoid repeated checks, particularly when monitoring many resources. | Repeated checks consume requests and can use API quota and resources. |
| Operational needs | Requires a reachable receiver, request validation, duplicate handling, and a recovery plan. | Requires a scheduler and a sensible polling frequency; it may be simpler for occasional checks. |
Choose a webhook when an event should prompt action promptly or when repeated checks across many resources would be wasteful. Polling remains practical when you need information only once or intermittently, or when you are watching a small set of resources that is unlikely to grow. GitHub discusses these trade-offs in its webhook documentation.
How to build a webhook receiver safely
1. Subscribe only to events you use
Limit the subscription to event types your application will handle. Unneeded subscriptions create avoidable requests and processing. Also check the event type and, where relevant, its action before interpreting the payload: different events can have different shapes and meanings. A sender field is not necessarily the person who caused an event.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match#1 Best Overall
2. Use HTTPS and verify the signature
Expose the receiver over HTTPS, keep certificate verification enabled, and store a high-entropy webhook secret securely. Do not put API keys or other credentials in the callback URL. Verify the provider’s signature against the raw request body before acting on the payload; parsing and re-serializing the JSON first can change the bytes being checked.
Signing headers and algorithms differ by provider. GitHub documents X-Hub-Signature-256, an HMAC-SHA256 digest of the request body made with the configured secret, and recommends it over the legacy SHA-1 header. Shopify documents X-Shopify-Hmac-SHA256, a base64-encoded HMAC generated from the raw body and the app’s client secret for HTTPS deliveries. Follow the instructions for the service sending the webhook rather than assuming one provider’s method applies to another. See GitHub’s signature-validation guidance and Shopify’s HTTPS webhook guidance.
Rank #2
3. Make duplicate deliveries safe
Do not assume an event arrives exactly once. A provider may retry after a timeout or an error, and duplicate deliveries can occur. Record delivery identifiers and make event processing idempotent where possible: receiving the same event again should not accidentally charge twice, create duplicate records, or repeat an irreversible action.
GitHub includes a delivery identifier in X-GitHub-Delivery. Shopify also warns that duplicate deliveries can happen, including after a timeout or retry. Use each provider’s documented identifier and delivery behavior when designing deduplication.
4. Acknowledge quickly and queue slow work
Keep the request handler short: validate the request, record or enqueue the event, and return a success response. A worker can then perform slow operations such as calling other APIs or running a deployment. GitHub recommends that a receiver return a 2XX response within 10 seconds; its documentation says it terminates a connection that takes longer and counts that delivery as failed. This is GitHub’s limit, not a universal webhook timeout. See GitHub’s webhook best practices.
5. Monitor delivery failures and plan recovery
Track failed requests and have a way to reconcile events your system missed. Retry schedules, manual redelivery options, and subscription-removal rules vary by provider, so build against the service’s own documentation rather than a presumed standard.
For example, Shopify documents eight retries over four hours when a delivery receives no response or an error. It also says that after eight consecutive failures, a subscription created through the Admin API is automatically deleted. These figures apply to Shopify’s documented behavior, not all webhook services. GitHub recommends redelivering missed deliveries after recovery. See Shopify’s webhook troubleshooting guidance and GitHub’s best practices.
6. Account for payload limits
Payload size can affect which events arrive and how you recover missing information. GitHub documents a 25 MB cap and says it does not deliver an event payload that exceeds that limit. Treat this as a GitHub-specific constraint; check the limits for any other provider you use. See GitHub’s webhook events and payloads documentation.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What webhooks do—and do not—guarantee
A webhook is an event-notification mechanism, not proof that your application has completed its work. A successful response acknowledges delivery to the receiver; it does not by itself confirm that a queued job finished or that a downstream system accepted the result. Design the receiver to validate, record, and process events in a way that can tolerate retries and support recovery.
There is no single delivery guarantee, signature format, retry schedule, timeout, or payload limit shared by every provider. Use the provider’s current documentation for those operational details. IP allowlisting may add a network barrier where supported, but it is not a substitute for validating a signed request.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
