What is a webhook? Definition and examples

A webhook is an HTTP request one application sends to a URL you choose as soon as a specific event happens, carrying the data about that event.

How it works

You give the sending application a URL and pick the events you care about: a new lead, a booked meeting, a closed deal. When one happens, the application sends a request to that URL with the details, usually as JSON. Your receiver, which can be your own code or an automation tool, reads it and does something: creates a record, posts a message, starts a workflow.

The alternative is polling: asking the other application's API every few minutes whether anything changed. GitHub's documentation sums up the difference: webhooks "receive data as it happens, as opposed to polling an API", they "require less effort and less resources than polling", and they allow "near real-time updates" (GitHub).

Because anyone who knows the URL could send fake requests, senders usually sign each delivery. GitHub, for example, uses a secret you set to compute an HMAC-SHA256 signature of the payload and sends it in the X-Hub-Signature-256 header. It advises you to "validate the webhook signature before processing the delivery further" and to compare signatures with a constant-time check, never a plain == (GitHub).

Why it matters for your website

Webhooks are how website tools hand data to the rest of your stack without anyone copying and pasting. A form tool, chat assistant or booking tool can send each new lead to your CRM, a Slack channel, a spreadsheet or an automation platform the moment it arrives.

A few habits keep them reliable:

• Verify the signature before trusting the data.
• Answer quickly with a success status and do slow work afterward, so the sender does not give up waiting.
• Expect repeats. Design the receiver so that processing the same event twice does no harm, for example by checking the event ID.
• Log failures somewhere a person will see them.

Example

A website assistant captures a lead and sends this webhook to an automation that creates a CRM contact and alerts the sales channel:

{
  "event": "lead.created",
  "id": "evt_8f2c41",
  "occurred_at": "2026-10-21T14:05:12Z",
  "lead": {
    "name": "Dana Ruiz",
    "email": "dana@northwind.example",
    "company": "Northwind Freight",
    "question": "Do you support SAML SSO on the Team plan?",
    "page": "https://acme.example/pricing"
  }
}

The receiver checks the signature header, stores the event ID so a retry is ignored, replies with a success status, and then creates the contact.

Related terms

• CRM: a common destination for webhook data.
• OAuth: how apps get permission to call each other's APIs.
• Meeting booking: booked meetings are a typical webhook event.
• Lead scoring: scores often update when webhook events arrive.