Receiving notifications from other systems.
WHAT A WEBHOOK IS
An external service calls a URL on your site when something happens: a payment completes, a repository receives a push, a form is submitted.
RECEIVING ONE
Create an endpoint that accepts a POST request, validates it, and acts.
SECURITY IS ESSENTIAL
An endpoint accepting unauthenticated requests can be called by anyone. For a payment webhook, that means anyone can mark an order paid.
Verify the signature the provider sends. Every reputable service provides one. This is not optional.
RELIABILITY
Respond quickly, then do the work. A slow response causes the sender to retry, producing duplicates.
Make the handler idempotent: processing the same event twice must not cause damage.
Log every received event so you can reconcile.
COMMON PROBLEMS
A security plugin blocking the request A redirect the sender does not follow The endpoint requiring authentication the sender cannot provide The signature check failing because the raw body was modified before verification
TESTING
Most providers offer a test mechanism and a log of delivery attempts. Use both.
