Engineering
What is Webhook?
A webhook is an HTTP notification a service sends to your URL when an event happens (payment confirmed, cancellation, etc) — "reverse API".
Instead of polling ("ask every 5 minutes"), the service pushes the event in real-time. Stripe, Mercado Pago, GitHub, Twilio, Slack — all use webhooks.
Best practices: validate signature (HMAC), return 200 fast (process async), idempotency (same event can arrive twice), and retry queue. Without that, fragile webhooks break production.
Frequently asked questions
Is webhook secure?
Only if you validate the signature (HMAC with provider secret). Without that, anyone can send a fake payload to your URL.
How to debug a failing webhook?
Structured logs + provider dashboard (Stripe/MP show history) + tools like Webhook.site to capture real payloads.