GlossaryAI & AutomationBeginner

Webhook

A webhook is an automated message sent from one app to another the moment an event happens. Instead of constantly asking for updates, your app gets notified instantly.

Last updated June 8, 2026

Definition

A webhook is a lightweight way for one application to send real-time data to another whenever a specific event occurs. Rather than repeatedly polling an API to ask "is there anything new?", the source system pushes an HTTP request, usually a POST with a JSON payload, to a URL you provide the instant something changes.

How webhooks work

You register a callback URL with the provider. When an event fires, such as a payment succeeding or a scraping job finishing, the provider sends an HTTP request to that URL carrying the event details. Your endpoint receives the data and triggers whatever logic you want. Many providers sign the payload with a secret so you can verify it is authentic.

Why webhooks matter for automation and scraping

  • Real-time reactions: kick off downstream workflows the moment data is ready.
  • Efficiency: no wasted requests polling for changes, which avoids hitting rate limits.
  • Scraping pipelines: a scraper can fire a webhook when a crawl completes so the next stage starts automatically.

Webhooks are a core building block of event-driven automation, connecting proxies, scrapers, and data tools without manual checks.

Examples

1

Stripe sending a webhook when a customer's payment succeeds

2

A scraping API POSTing results to your endpoint when a job finishes

3

GitHub triggering a CI/CD pipeline via a push webhook

Common Use Cases

Triggering downstream workflows the instant a scraping job completes
Receiving real-time payment or subscription events
Connecting SaaS tools together without polling APIs
Notifying a Slack channel or database when data changes

Frequently Asked Questions

An API is something you call to request data, while a webhook calls you when an event happens. Webhooks are push-based and event-driven; traditional API calls are pull-based and require you to ask repeatedly.
Verify the signature most providers attach to each payload using a shared secret, accept only HTTPS, and validate the source IP or token before processing. This prevents attackers from sending forged events to your endpoint.