A webhook is an HTTP callback — a mechanism where one server sends real-time data to another when a specific event occurs. Instead of polling an API repeatedly, webhooks push data to your endpoint the moment something happens.

Testing Webhooks

When developing locally, your server is not publicly accessible. Tools like ngrok, Cloudflare Tunnel, or localtunnel create a temporary public URL that tunnels requests to your local machine.

Security: HMAC Signatures

Production webhooks should verify the sender using HMAC signatures. The sending server signs the payload with a shared secret, and your server recomputes the signature to confirm authenticity. Common headers: X-Hub-Signature-256 (GitHub), Stripe-Signature (Stripe).

CORS Limitations

Browsers enforce Cross-Origin Resource Sharing (CORS) policies. If the target server does not return an Access-Control-Allow-Origin header matching your origin, the browser blocks the response. To bypass CORS during testing, use a server-side proxy or a browser extension.