What is a webhook?
Corbin Brown
2 min read
Part of the Vibe Coding Fundamentals video series on YouTube.
You already know that an API is your app calling a service: “Stripe, charge this card.” A webhook is the reverse: the service calling your app when something happens on its side. “Hey — that subscription payment just went through.” “That customer just canceled.” Without webhooks, your app would have to ask Stripe “anything new? anything new?” every few seconds forever. With them, your app has a doorbell.
How the doorbell works
Your app publishes a URL — something like yourapp.com/api/webhooks/stripe — and you register it in the service's dashboard: “when events happen, ring here.” When a payment succeeds, Stripe sends a message to that URL describing what happened, and your code reacts: mark the user paid, unlock the feature, send the receipt. The whole pattern is three parts — a URL you expose, an event that fires, a handler that reacts.
This is the piece that makes payment integrations real. The checkout page collects the card, but the webhook is where your app learns the money actually moved — it's the difference between a store with a cash register and a store that knows what sold.
The two ways vibe coders get bitten
- Webhooks can't ring localhost. While developing, your app lives at an address only your machine can see — Stripe can't reach it. Tools like the Stripe CLI or a forwarding tunnel fix this; if payments “work but nothing updates” in development, this is almost always why.
- Anyone can ring a doorbell. Your webhook URL is public, so your handler must verify each message actually came from the service — every provider sends a signature for exactly this. If an agent writes a handler without signature verification, anyone who finds the URL can fake a “payment succeeded” event. Worth asking your agent about directly.
FAQ
What happens if my app is down when the webhook fires?
Good services retry — Stripe re-rings for days with increasing gaps. This is also why handlers should be idempotent (a word agents know): built so processing the same event twice doesn't double-unlock or double-charge anything.
How do I see what a webhook actually sent?
The provider's dashboard keeps a log of every delivery, its contents, and your app's response — Stripe's is under Developers → Events. When a webhook flow misbehaves, that log plus your own server logs is the whole investigation.