Definition
A webhook is a way for one piece of software to notify another the instant something happens. Instead of your system asking a provider every few minutes "has anything changed?", the provider sends a message to a URL you specify as soon as an event occurs: a payment succeeded, a form was submitted, a shipment was delivered. It is push instead of pull, and it is one of the simplest building blocks of software automation.
In a company, webhooks are the glue between tools. Your payment processor fires a webhook when a subscription renews, and your system updates the customer record and sends an invoice. Your CRM (Customer Relationship Management system) fires a webhook when a deal closes, and your onboarding sequence starts. No-code automation platforms are largely webhook plumbing with a friendly interface. Most modern SaaS products expose webhooks so customers can build their own workflows on top.
Webhooks are simple, but production-grade webhooks need care: the receiving system must verify the message is genuine, handle the same event arriving twice, and cope with the sender retrying when your server is down. A frequent misconception is that a webhook and an API (Application Programming Interface) are the same thing. An API is you asking a system for data; a webhook is the system telling you something happened. Good integrations use both.
In practice
When a customer pays through a checkout page, the payment provider sends a webhook to the company's backend within seconds, which activates the account, posts the sale to the accounting tool and notifies the sales channel. Nobody touches a keyboard.
Why it matters
Every hour of manual copy-paste between tools in your company is a webhook that was never set up. Ask your team which events in your business still depend on someone noticing them.
Frequently asked questions
- What is the difference between a webhook and an API?
- An API lets your software request data or actions from another system whenever it wants. A webhook reverses the direction: the other system sends a notification to yours automatically when an event happens. APIs are pull, webhooks are push, and most integrations combine the two.
- Are webhooks secure?
- They can be, if implemented properly. The sender signs each message with a secret so the receiver can verify it is genuine, the connection is encrypted with HTTPS, and the receiver treats duplicate or unexpected events defensively. A webhook endpoint that accepts any message without checking the signature is a security hole.