A webhook is the other system sending an HTTP request to an address you chose, the moment an event happens. You don't ask — when the event occurs, the news arrives. Most notifications triggered when a payment completes, a commit lands, or a form is submitted work this way.
How a webhook differs from an API call
With an API call, the question comes from you. Every five minutes you ask "anything new?" and most answers come back empty. With a webhook, the direction is reversed: the other system sends a single request only when something happens.
That reversed flow changes three things:
- Latency drops to seconds — no waiting for the next polling interval
- Far fewer wasted requests
- Your endpoint now has to be up and reachable at all times
How to test a webhook
What needs testing is the behavior at your end — the outgoing request is the provider's job. The sequence goes like this:
1. Take the sample payload from the provider's docs and send a POST request with that exact body to your own address.
2. Test signature verification: corrupt the signature header that ships with the body and confirm the request gets rejected.
3. Send the same request twice. If your system processes the same event twice, you're creating duplicate records.
4. Take the endpoint down, bring it back up, and read the provider's retry behavior.
GitHub's webhook documentation covers event types, signature verification, and redelivery behavior with sample payloads.
Testing in a local environment needs one extra step: the provider's request can't reach your machine, so you either use a tunnel tool or send the sample payload by hand. The second method also lets you test signature verification.
The three most common mistakes
Skipping signature verification leaves the address open to anyone. Responding slowly makes the provider hit its timeout and resend the request. And leaving out the duplicate check turns a single payment into two records.
Where Lodos shortens this flow
API Post/Get is used to hit the endpoint, tweak headers, and inspect the response; for recurring triggers, the Automation module steps in. The rest of the developer-side modules are on the Developers page.
Here's the limit: Automation is capped at one rule on the free Standard plan and ten rules on Basic. Production flows that need a complex retry queue still require your own code.
FAQ
Are webhooks secure? They are when signature verification is in place. Without it, anyone who knows the address can send fake events.
What happens when a webhook fails? Most providers resend the request at set intervals. The retry count and window are in the provider's documentation.