Webhooks are one of those concepts that clicks immediately once someone explains them properly. Here's the proper explanation.
The problem they solve
Imagine you want to know when something happens on an external service — a payment completes, a GitHub push happens, a form gets submitted. The naive approach is polling: ask the service every few seconds "has anything happened yet?" This is wasteful — most of the time the answer is no, and you're making thousands of unnecessary requests.
Webhooks flip the model. Instead of you asking repeatedly, you give the service a URL and say "when something happens, send a POST request to this URL." The service calls you. You don't have to ask.
What a webhook request looks like
When the event happens, the service sends a POST request to your URL with a JSON body describing what occurred:
POST https://yourapp.com/webhooks/github
Content-Type: application/json
X-GitHub-Event: push
{
"ref": "refs/heads/main",
"repository": { "name": "my-repo" },
"commits": [...]
}
Verifying webhooks
Anyone can send a POST request to your webhook URL. Services include a signature in the request headers — a hash of the body using a shared secret — so you can verify the request actually came from them. Always verify webhook signatures. Skipping this means anyone can trigger your webhook handler.
// Verify GitHub webhook signature
const signature = req.headers['x-hub-signature-256'];
const expected = 'sha256=' + crypto
.createHmac('sha256', process.env.WEBHOOK_SECRET)
.update(req.rawBody)
.digest('hex');
if (signature !== expected) return res.status(401).send('Invalid');
Where I use them
Webhooks are everywhere in the hosting stack — payment provider notifications, GitHub push events triggering deployments, Discord notifications when server events happen. Once you understand them you'll find them being used everywhere you look in modern web infrastructure.