A webhook is an HTTP callback: the source POSTs to your URL when an event happens, instead of you polling on a timer.
You register an HTTPS endpoint and the event types you care about. When that event fires, the source service sends an HTTP POST to that URL with a JSON body that names the type and the object. Headers often include a delivery id and an HMAC signature over the raw body. Your server verifies the signature with the shared secret, parses JSON, runs the handler, and returns 200.
There is no loop of GET /events every few seconds. Polling burns API quota and adds delay equal to the poll interval. Push sends the payload when the event exists.
Stripe POSTs when a payment succeeds or fails, including the charge id so you can mark an order paid once. GitHub POSTs on push, pull_request, and workflow_run. A push webhook is what starts CI/CD: the runner clones the SHA in the payload, runs tests, and deploys if they pass. Slack POSTs when a message lands in a channel.
Shopify POSTs for new orders, inventory updates, and canceled subscriptions. The HTTP pattern is the same: your URL, a POST, JSON, a signature header.
If the endpoint times out or returns 5xx, vendors retry with backoff. Network duplicates happen, so the handler must be idempotent on event id or delivery id. Return 2xx only after the work is safe to skip on a replay. Use HTTPS only. Rotate the signing secret. Log delivery ids next to git SHAs when the event is a push. Subscribe to the smallest event list you need so you do not process noise.
A GitHub push body includes ref, before, after, and the commit SHA you check out. Verify that SHA matches git rev-parse HEAD in CI before you deploy. Webhooks replace constant polling and are how services chain without a shared database.
Stripe, GitHub, Slack, and Shopify still POST JSON to your HTTPS URL. You still return 200. You still verify a signature. You still retry on failure. You still treat duplicate deliveries as one logical event. MDN: the source service POSTs to your URL when an event happens. Stripe, GitHub, and Slack all use this instead of asking you to poll.
Webhooks in Action
Watch events get pushed to your endpoint in real-time instead of polling
Webhooks push data to your server the instant an event happens. Instead of repeatedly asking "has anything changed?" (polling), the source app sends an HTTP POST to your endpoint automatically. Failed deliveries are typically retried with exponential backoff.