A webhook allows one system to notify another system when an event occurs.

A webhook endpoint should authenticate the sender, validate the payload, reject stale or malformed requests, and process events idempotently.

Webhook delivery is normally asynchronous. The sender should retry failed deliveries using an appropriate backoff strategy. The receiver should respond quickly and move expensive processing to a background queue.

Webhook signatures often use HMAC so the receiver can verify that the payload was produced by a trusted sender.