Webhook
A webhook is an HTTP callback a service pushes to you when an event happens, inverting who initiates the request.
A webhook is a plain HTTP request one service sends to a URL you registered, fired when some event happens on their end — inverting the usual client-pulls-data model into the server pushing to you instead. Where a normal API call means you asking "did anything change yet?" on a timer, a webhook means the other side telling you the moment it did, which is both more timely and dramatically cheaper than polling for most event-driven integrations.
The mechanics are unglamorous: it's a POST request with a JSON body, sent to whatever URL you configured, with no persistent connection and no guarantee of order or even single delivery. That last part is the trap people miss — most webhook senders retry on failure (a timeout, a non-2xx response) without checking whether the first attempt actually succeeded downstream, so a receiver has to be built for duplicate deliveries. This is exactly why Idempotence matters at the receiving endpoint: processing the same event twice should have the same effect as processing it once, typically by keying off an event ID and short-circuiting anything already handled.
Verifying a webhook actually came from who it claims to be usually means checking a signature the sender computes over the payload with a shared secret (HMAC), sent in a header — since anyone can guess a webhook URL and POST arbitrary JSON at it, and a receiver that trusts the body blindly is trusting the internet. An API Gateway sitting in front of the receiving endpoint is a natural place to enforce that check once, rather than in every handler.
Webhooks are also a poor fit for anything that needs a response mid-transaction — they're fire-and-forget by design, which is why bidirectional real-time needs look instead to a persistent WebSocket (or WebRTC for peer-to-peer media), not a webhook.
See also8
Race Condition
A defect whose occurrence depends on the relative timing of concurrent operations.
Testing & Verification36 connections
Streaming Response
Delivering a response incrementally as it is produced rather than all at once when complete.
Networks & Distribution20 connections
Long Polling
The ways a client learns that something changed on a server, from asking repeatedly, to holding a request open until there's news, to the push channels that replaced both.
Networks & Distribution11 connections
MQTT
A lightweight publish-subscribe protocol in which devices send small messages to topics on a central broker, the common language of sensors, smart homes, and industrial telemetry.
Networks & Distribution9 connections
Server-Side Request Forgery
Tricking a server into making requests on an attacker's behalf, reaching internal services and cloud credential endpoints that the attacker could never reach directly, behind some of the largest cloud breaches.
Web Platform14 connections
OpenAPI
A standard, machine-readable format for describing HTTP APIs, listing every endpoint, parameter, and response shape, from which tools generate documentation, client libraries, mock servers, and tests.
Web Platform11 connections
Git Hook
Scripts Git runs automatically at points such as committing or pushing, used to check formatting and messages locally, and on servers to enforce policy or trigger deploys.
Version Control & Delivery15 connections
Idempotency Key
A unique token a client attaches to a request so the server can recognize a retry and return the original result instead of doing the work twice, the standard defense against double charges and duplicate orders.
Data & Content10 connections
Linked from9
- API GatewayNetworks & Distribution
An API gateway is the single front door to a set of backend services, handling cross-cutting policy once instead of per-service.
- Background AgentAgents & Language Models
An agent run that continues without a person watching, started by a schedule, an event, or a handoff, and reports its results when done.
- Cross-Tab CommunicationWeb Platform
Keeping several open tabs of the same app consistent, best done by broadcasting small notifications and letting each tab re-read the truth.
- Exponential BackoffNetworks & Distribution
Waiting longer after each failed attempt, with a dose of randomness, so retries give a struggling system room to recover instead of hammering it.
- Git HookVersion Control & Delivery
Scripts Git runs automatically at points such as committing or pushing, used to check formatting and messages locally, and on servers to enforce policy or trigger deploys.
- Idempotency KeyData & Content
A unique token a client attaches to a request so the server can recognize a retry and return the original result instead of doing the work twice, the standard defense against double charges and duplicate orders.
- Long PollingNetworks & Distribution
The ways a client learns that something changed on a server, from asking repeatedly, to holding a request open until there's news, to the push channels that replaced both.
- MQTTNetworks & Distribution
A lightweight publish-subscribe protocol in which devices send small messages to topics on a central broker, the common language of sensors, smart homes, and industrial telemetry.
- Server-Side Request ForgeryWeb Platform
Tricking a server into making requests on an attacker's behalf, reaching internal services and cloud credential endpoints that the attacker could never reach directly, behind some of the largest cloud breaches.