What Is a Webhook?

A webhook is an automated message one app sends to a URL you choose. It fires the moment a chosen event happens, such as a payment clearing or a form being submitted. Red Hat describes it as event-driven communication that automatically sends data between applications via HTTP (Red Hat). Instead of your system asking an API over and over whether something changed, the source pushes the data the instant it is ready.

That small difference is what makes tools react to each other in real time.

How does a webhook work?

A webhook works by waiting for a specific event, then sending its data to a preset URL called the endpoint. You register that URL once with the source app and pick which events matter to you.

GitHub explains that webhooks let you subscribe to events happening in a software system and automatically receive a delivery of data to your server whenever those events occur (GitHub). When the event fires, the source sends an HTTP request carrying the event details to the URL you specified.

Your endpoint reads that data and acts on it. It might save a new lead, update a record, or send you a notification.

How is a webhook different from an API?

A webhook and an API both move data between systems, but they run in opposite directions. With an API, your app asks for data when it wants it. With a webhook, the data is pushed to you the moment it exists.

GitHub's guidance frames the contrast plainly: webhooks receive data as it happens, rather than polling an API to check whether new data is available. Polling means asking again and again, which wastes requests and adds delay.

	Webhook	API call
Who starts it	The source app, on an event	Your app, when it asks
Timing	The instant the event happens	Whenever you next check
Effort on your side	Wait and receive	Keep asking

This is why a webhook is sometimes called a reverse API. Red Hat uses the terms reverse APIs or push APIs, because the server does the reaching out instead of your app.

What are webhooks used for?

Webhooks connect the tools a business already runs so they react to each other without anyone copying data by hand. Most everyday automation on a small business site is a webhook underneath.

• A payment gateway tells your site an order was paid, so you can start fulfillment.
• A contact form sends each new lead straight into a CRM or Google Sheet.
• A chat tool posts a message in WhatsApp or Slack when someone submits a form.
• An AI chatbot hands a qualified inquiry to your sales inbox.

Take a quote form on a Kuala Lumpur contractor's site. A webhook can drop each submission into a shared sheet and ping the owner's phone at the same time. The lead is seen in seconds, not at the next inbox check. (Illustrative example, not a client result.)

Are webhooks safe to use?

Webhooks are safe when your endpoint verifies who sent the data and the exchange runs over HTTPS. Because the endpoint URL sits open on the internet, anyone who finds it could try to send fake events.

Two safeguards handle that risk. The source signs each message with a shared secret, so your endpoint can confirm it is genuine. The whole exchange runs over HTTPS, so the contents cannot be read in transit.

A well-built integration checks the signature before it trusts a single field. In our experience, neglected sites turn up spammed or injected, and an endpoint that trusts any sender is one more way in.

Frequently asked questions

Do I need to be a developer to use webhooks?

Not always, because many tools handle webhooks for you. Form builders, payment gateways, and CRMs often let you paste in a destination URL and pick events from a menu, with no code involved. No-code connectors sit between apps and manage the webhook wiring on your behalf. You only need a developer for a custom endpoint that processes the data in a specific way, or when two tools do not already speak to each other.

What is a webhook URL?

A webhook URL, or endpoint, is the address the source app sends its data to. You create it on the receiving side, such as your CRM, a connector, or your own server, then paste it into the sending app's settings. When the event happens, the payload arrives at that address. Treat the URL as semi-private and pair it with a signing secret, since anyone who has it could attempt to send data to it.

What is a webhook payload?

A payload is the packet of data a webhook delivers, describing what just happened. For a paid order it might include the amount, the order number, and the customer's details; for a form it might carry the name and message. The payload usually arrives as JSON, a plain-text data format that both machines and people can read. Your endpoint reads the fields it needs and ignores the rest.

Are webhooks the same as an API?

No, though they are closely related and often used together. An API is something your app calls when it needs data or an action. A webhook is the reverse: the other system calls you when an event occurs. Many platforms offer both, an API for when you ask, and webhooks for when they need to tell you something happened. They solve the same problem from opposite ends.

What happens if my site is down when a webhook fires?

The delivery can fail, and what happens next depends on the source. Some providers retry a failed webhook automatically, but GitHub does not automatically redeliver failed webhook deliveries (GitHub Docs, read November 2026); you redeliver them by hand or by code. Even so, a webhook is a notification, not a permanent record, so critical data should still be readable from the source's API or dashboard as a backup. Build the receiving side to accept a repeat of the same event without doubling up.

Wiring your tools to work together

Storming Solutions builds custom-coded websites for Malaysian businesses from Kuala Lumpur, maintains existing sites, and runs SEO, AEO, and GEO. We would rather a lead or an order trigger the next step by itself than wait for someone to notice it.

Want your form, payment, or chat tools to talk to each other automatically? Message us about web development, or read our guide to connecting website forms to a CRM or Google Sheets.