What Is a Webhook Endpoint? How It Works, Examples, and Security Checklist

TL;DR: A webhook endpoint is an HTTPS URL in your application that receives event notifications from another service. The provider sends an HTTP request when something happens, and your endpoint verifies the request, stores the event safely, and processes it without blocking the sender.

Why This Topic Matters

Your Search Console data shows interest around "what is a webhook endpoint." That query is usually from developers and product teams trying to connect payments, GitHub, CRMs, automation tools, or SaaS platforms.

GitHub describes webhooks as a way for notifications to reach an external web server when events occur. The important word is "external": your application must expose an endpoint that another system can call.

Webhook Endpoint Definition

A webhook endpoint is:

• a public HTTPS URL,
• owned by the receiving application,
• configured inside the sending service,
• called when a subscribed event happens,
• responsible for verification, storage, and processing.

Example endpoint:

https://api.example.com/webhooks/github
https://api.example.com/webhooks/stripe
https://app.example.com/api/webhooks/order-created

Webhook Endpoint vs API Endpoint

How A Webhook Endpoint Works

1. You create an endpoint in your application.
2. You register that URL in the provider dashboard.
3. The provider sends an HTTP request when an event happens.
4. Your endpoint verifies the signature or secret.
5. Your endpoint stores the event and returns a fast 2xx response.
6. A background worker processes the event safely.

Production Webhook Checklist

GitHub recommends validating webhook deliveries with a secret token so the receiver can verify payload integrity. That same idea applies to most production webhook providers.

Node.js Example

import crypto from 'node:crypto';
import express from 'express';

const app = express();

app.post('/webhooks/github', express.raw({ type: 'application/json' }), async (req, res) => {
  const signature = req.header('x-hub-signature-256') ?? '';
  const expected =
    'sha256=' +
    crypto.createHmac('sha256', process.env.WEBHOOK_SECRET!).update(req.body).digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).send('Invalid signature');
  }

  // Store first, process later.
  await saveWebhookEvent({
    provider: 'github',
    deliveryId: req.header('x-github-delivery'),
    payload: JSON.parse(req.body.toString('utf8')),
  });

  return res.status(202).send('Accepted');
});

Common Mistakes

• processing the full workflow before returning a response,
• trusting the request without verifying the signature,
• not handling duplicate deliveries,
• not storing raw payloads for debugging,
• accepting every event instead of subscribing only to needed events,
• using one endpoint for every provider without clear routing.

When SoftwareCrafting Can Help

We build webhook-heavy backend systems for payments, billing, CRMs, logistics workflows, GitHub automation, and SaaS integrations. If you need reliable API integrations, see our backend API services or send a brief.

Sources

• GitHub Docs: About webhooks
• GitHub Docs: Validating webhook deliveries

Frequently Asked Questions

Is a webhook endpoint just a URL?

It is a URL, but in production it also needs verification, logging, idempotency, retries, monitoring, and safe background processing.

Should webhook endpoints return 200 or 202?

Use a 2xx response when the event is accepted. Many systems use 202 Accepted when the event is queued for later processing.

Can a webhook endpoint be private?

Usually it must be reachable by the provider. Some systems support private delivery through tunnels, reverse proxies, or private connectivity.

Do webhooks need authentication?

They need verification. Most providers use signatures, shared secrets, or tokens rather than normal browser-style login.

What happens if my endpoint fails?

Most providers retry failed deliveries. Your endpoint should be idempotent so repeated events do not create duplicate side effects.