A webhook is an HTTP request that a service sends to a URL you register whenever a specific event happens. It lets your system receive data as it happens, instead of polling an API by calling it again and again to see if anything new is available. In a data pipeline, that means a job can react to an event as soon as the source reports it.

Payment platform Stripe, for example, sends webhook events to your endpoint over HTTPS as a JSON payload. Your endpoint must accept POST requests and process the event data it receives.

How Webhook Delivery Works

Stripe's documentation shows the main mechanics:

  • Registration: You register an endpoint URL. In live mode, Stripe requires a publicly accessible HTTPS URL.
  • Fast acknowledgment: The endpoint should return a 2xx status code quickly, before any complex logic that could cause a timeout.
  • Retries: If delivery fails, Stripe retries for up to three days with exponential backoff in live mode.
  • Ordering: Stripe does not guarantee that events arrive in the order they were created.

Securing a Webhook Endpoint

  • Verify signatures: Stripe signs each event with an HMAC using SHA-256 and puts the signature in the Stripe-Signature header.
  • Block replays: The signed payload includes a timestamp, so you can reject events that are too old.
  • Handle duplicates: An endpoint can receive the same event more than once. Log processed event IDs and skip repeats.
  • Allowlist senders: Stripe sends webhooks from a published list of IP addresses that you can restrict your firewall to.

Common Webhook Uses

  • Code and deployment: GitHub sends an HTTP POST payload to your URL for the repository events you subscribe to. Its docs list uses such as starting CI builds, updating an external issue tracker, refreshing a backup mirror and deploying to a production server.
  • Payments: Stripe webhooks let you respond to asynchronous events, such as a bank confirming a payment, a customer disputing a charge or a recurring payment succeeding.
  • Subscribe only to what you need: Stripe advises against listening for extra or all events because it puts undue strain on your server.