What is a webhook?
A webhook is a type of API, or application programming interface, which allows a given web application to send data to another application when predefined events occur. While most APIs handle two-way data exchanges between disparate software based on user requests, webhooks send data one-way when certain events occur. For example, a webhook might send the length of time a user spent on a page whenever a user leaves the page. Webhooks can also be called “web callbacks” or “HTTP Push APIs”.
Developers use webhooks along with other APIs to create and manage connections between their own software and other applications. Because webhooks send data triggered by events, they are typically favored over APIs when the developer wants to accumulate data over time. By contrast, APIs tend to be more useful when developers want data sharing to occur at instances defined by user behavior. While other types of APIs make requests for data and return a result, webhooks passively wait for data events to occur.
To set up a webhook, clients create a webhook URL which they provide to the webhook provider. From then on, the providing webhook sends data to that webhook URL for ingestion by the client’s application. The client’s application validates incoming webhook requests to ensure that the incoming data is from the provider and not a security threat, then receives the data.
Like other APIs, the information that can be monitored and sent by a given webhook is governed and understood by both the host site and the client site via comprehensive documentation. This mutual “contract” allows both parties to protect sensitive data, as a webhook will package no more data than is necessary to fulfill the webhook owner’s desired output. In this way, neither application fully exposes its own or its users’ data.
Benefits of using webhooks
- Reduced workload: Developers rely on webhooks to provide their software applications with information as events occur. Rather than monitoring these events themselves, developers can simply establish a flow of information with a webhook that tracks events for them. This reduces workload and allows developers to focus on other aspects of the projects they’re working on.
- Smoother web operations: Webhooks allow companies to connect their otherwise disparate web applications, which assists with direct and efficient data sharing between those systems. This improves a company’s web presence and performance by helping to keep its web apps in sync with one another automatically.
- Notifications: When developers want to implement notifications for their users, webhooks provide an easy way to do so without spending development effort on more robust forms of APIs. Webhooks require less time and resources to build and implement than other types of APIs so they serve as an efficient solution in use cases like this.
- Improved user experiences: Webhooks’ data sharing capabilities have many use cases, including the ability to personalize and improve user experiences based on data collection. For example, a company analyzing its web application’s user behavior data exposed by webhooks can discover pain points in the customer journey and work to resolve them. At the same time, companies can use webhooks to discover which parts of their web applications are getting the most engagement and capitalize on that.
- Focused marketing: In much the same way that companies can improve user experiences by analyzing the behavioral data exposed by webhooks, marketing efforts benefit from that same data and allow companies to target ads to specific audiences. By catering content to users based on behavioral and demographic data, marketers gain an advantage that makes engagement more likely. Companies can then continue to track that engagement, creating a positive feedback loop that maximizes campaign effectiveness.
Impacts of using webhooks
Software development companies could be negatively impacted by reliance on webhooks:
- Security risks: Companies using webhooks must take measures to ensure that their connections aren’t exposing them to security vulnerabilities. Webhook clients can verify incoming webhook requests by validating the request’s signature against the one from the host’s company. Users can also password protect their webhook URL so that only the host and client have access. These practices help to protect against threats like spoofing attacks—a type of attack in which bad agents falsify data to assume the identity of a webhook host.
- Lack of functionality: Webhooks are more lightweight than other APIs, making them an attractive tool for developers looking to ingest data from other web applications. However, webhooks’ easy-to-implement nature does not automatically make them a better solution than more robust APIs. In many cases, putting in the extra effort to connect two-way APIs that can share data when API requests are made will serve developers better than a webhook can. At a certain point, trying to force webhooks as a viable solution will actually cost developers time and resources.
Adam Crivello
Adam is a research analyst focused on dev software. He started at G2 in July 2019 and leverages his background in comedy writing and coding to provide engaging, informative research content while building his software expertise. In his free time he enjoys cooking, playing video games, writing and performing comedy, and avoiding sports talk.
