A webhook is a way for one app to tell another, instantly, that something has happened. Instead of your system asking a payment provider every few minutes "any new payments?", the provider sends a small message to a web address you gave it as soon as a payment goes through. Twilio describes it as an HTTP request sent to a URL you provide after certain events occur.
Why it matters for your business
Webhooks are what make automation feel immediate. A lead fills in a form and the sales team gets a WhatsApp alert within seconds. A customer pays and the invoice is marked paid without anyone touching it. Without webhooks, systems either check each other on a timer, which is slower and wasteful, or a person copies data across by hand.
They also explain many "it stopped working" moments. If the receiving address changes, goes down or rejects the message, the event can be missed, and nothing on screen tells you. That is why good automation includes logging and alerts for failed deliveries.
An example
A clinic takes deposits online. When a payment succeeds, the payment provider sends a webhook to the clinic's system. The system checks the message is genuine, replies "received", then confirms the appointment, sends the patient a WhatsApp confirmation and adds a row to the accounts sheet.
Stripe's documentation shows the details that matter in practice: your endpoint should return a success code quickly before running slow work, check the signature Stripe adds in the Stripe-Signature header, and expect retries. Stripe retries failed live deliveries for up to three days, does not guarantee events arrive in order, and occasionally sends the same event twice.
How to use it
| Good practice | Why |
|---|---|
| Verify the signature on every message | Stops fake requests from triggering orders or access |
| Reply with a success code fast, then process | Slow replies time out and trigger retries |
| Record event IDs and skip ones already handled | Duplicates happen; nobody wants two invoices |
| Do not rely on arrival order | Events can arrive out of sequence |
| Log failures and alert a person | Missed events are otherwise silent |
| Subscribe only to events you use | Less noise, less load |
Our post on the Twilio WhatsApp API shows webhooks at work for incoming messages. If you want us to connect your forms, payments and messaging so they act on events automatically, see our workflow automation service.
Frequently asked questions
What is the difference between a webhook and an API?
With an API, your system asks another system for data when it wants it. With a webhook, the other system pushes data to you when an event happens. Most integrations use both: the webhook says "something changed", then an API call fetches the full details.
Are webhooks secure?
They can be, if the receiving end checks each message. Providers such as Stripe and Twilio sign their webhooks so you can confirm a request really came from them. An endpoint that accepts unsigned messages can be fooled by anyone who finds the address.
Do I need a developer to use webhooks?
Tools like Zapier, Make and n8n can receive webhooks without code for simple flows. A developer helps when the flow touches money, customer data or several systems, where signature checks, retries and duplicate handling need to be done properly.
Last reviewed 22 Oct 2026 by the Astrafolio team.