CyberFreezeDev Loading
  1. Home
  2. AI glossary
  3. Webhook

What is a webhook?

An app calling your system the moment something happens, instead of you checking for news.

Book a consultation
3D render of small AI agent units on plinths, cabled to a central orchestrator unit

Definition

A service sends an HTTP request to your URL when an event happens, such as a payment, instead of you polling. It is the usual workflow trigger.

Read more about Definition

A webhook is an automated HTTP request, usually a POST with a JSON body, that a service sends to a URL you register whenever a chosen event happens. Instead of your system asking "anything new?" every few minutes (polling), the other system tells you as soon as there is.

Typical events: a Razorpay payment is captured, a Shopify order is created, a WhatsApp Business message arrives, a form is submitted. In workflow automation, a webhook is the most common trigger.

How it works

  1. 01 Register

    Give the provider an HTTPS URL and choose the events to subscribe to.

    Read more about Register

    You give the provider an HTTPS URL and choose which events to subscribe to. In n8n, the Webhook node gives you separate test and production URLs.

  2. 02 Event fires

    The provider sends the event data and headers, often with a signature.

    Read more about Event fires

    The provider sends a request with the event data and headers, often including a signature.

  3. 03 Verify

    Your endpoint checks the signature with a shared secret before trusting the event.

    Read more about Verify

    Your endpoint checks the signature with a shared secret. Razorpay, for example, signs the raw body with HMAC SHA256 in the X-Razorpay-Signature header; Shopify uses X-Shopify-Hmac-Sha256.

  4. 04 Acknowledge quickly

    Reply fast with a success status and do heavy work afterwards in a queue.

    Read more about Acknowledge quickly

    Return a 2xx status fast. Do heavy work afterwards, in a queue, or the provider may time out and retry.

  5. 05 Process once

    Use the event ID to ignore duplicates, because providers retry.

    Read more about Process once

    Use the event ID to ignore duplicates, because providers retry and the same event can arrive twice.

Where it matters in business

Payments

Mark orders paid when the gateway confirms, not when the customer's browser says so.

Read more about Payments

Mark orders paid and issue invoices when the payment gateway confirms, not when the customer's browser says so.

Messaging

Incoming WhatsApp messages reach your webhook and feed a CRM or an AI agent.

Read more about Messaging

The WhatsApp Business Platform delivers incoming messages to your webhook, which feeds a CRM or an AI agent.

Connecting AI steps

AI orchestration runs often start with a webhook and end by calling another.

Read more about Connecting AI steps

An AI orchestration run often starts with a webhook and ends by calling another system's webhook.

A practical example

A Shopify order webhook starts an n8n workflow that verifies, skips duplicates, records the sale and sends a WhatsApp message. A nightly check catches misses.

Read more about A practical example

A Shopify store wants new orders in its accounting tool and a WhatsApp confirmation sent. An orders/create webhook calls an n8n workflow. The workflow verifies the HMAC header, checks the order ID against a log of processed IDs, replies 200, then creates the sales entry and sends the message. A nightly job compares the day's Shopify orders with the log to catch any webhook that never arrived.

Common mistakes

Skipping signature checks

Anyone who finds the URL can send fake events. Always verify signatures.

Read more about Skipping signature checks

Anyone who finds the URL can send fake events. Always verify.

Doing slow work before replying

Slow work before replying invites timeouts and duplicate retries.

Read more about Doing slow work before replying

Calling an LLM for 20 seconds before answering invites timeouts and duplicate retries.

Trusting webhooks as the only record

Deliveries can fail after retries run out. Reconcile with the provider's API on a schedule.

Read more about Trusting webhooks as the only record

Deliveries can fail after retries run out. Reconcile against the provider's API on a schedule.

Related terms and pages

Questions

What is the difference between a webhook and an API?

With an API, your system makes a request when it wants data. With a webhook, the other system makes a request to you when something happens. Most integrations use both: webhooks for instant events, the API to fetch details and reconcile.

What happens if my webhook endpoint is down?

Most providers retry for a period with increasing gaps, then give up. Some disable the webhook after repeated failures. Monitor your endpoint and reconcile missed events through the API.

Is a webhook URL a secret?

Treat it as sensitive, but do not rely on secrecy. Signature verification is what proves a request came from the real provider.

Last updated