A webhook is an HTTP callback — a server-to-server request that one system sends to another when a specific event occurs. Instead of your app constantly polling an API to check for changes (pull), the external service pushes the data to you the moment something happens (push).
With a regular API, your code initiates the request: "Hey Stripe, do I have any new payments?" You ask repeatedly until something changes. This is polling. It wastes requests, adds latency, and scales poorly.
With a webhook, Stripe calls your URL: "Here's a new payment event." You get the data instantly, only when something actually happens. No wasted requests. No delay.
https://yourapp.com/webhooks/stripe)Your endpoint needs to:
Most webhook providers sign each request with a shared secret (usually HMAC-SHA256). The signature arrives in a header like X-Signature or Stripe-Signature. Compute the expected signature from the raw request body and your secret key, then compare. If they don't match, reject the request.
Always register an HTTPS URL. Webhook payloads often contain sensitive data — customer emails, payment amounts, account IDs. HTTPS encrypts the payload in transit.
Some providers publish their IP ranges. Where available, restrict your webhook endpoint to only accept requests from those IPs.
An API is pull-based: your code makes a request to get data. A webhook is push-based: the external service sends data to your URL when an event happens. Webhooks are more efficient when you only care about changes.
Almost all webhooks use HTTP POST. The event data is sent in the request body as JSON. Some older systems use GET with query parameters, but POST is the standard.
Use a tool like our webhook tester to send test requests to any endpoint and inspect the response. For local development, use a tunneling service (like ngrok) to expose your local server to the internet, then point the webhook URL at your tunnel.
Always handle webhooks idempotently to survive duplicate deliveries. For heavy processing, queue the webhook payload as a background job and return 200 immediately — this prevents timeouts from causing unnecessary retries.
Recuro handles cron scheduling, retries, alerts, and execution logs -- so you can focus on building your product.
No credit card required