Webhooks: Push vs Pull
Instead of polling an API periodically to check for updates, webhooks allow the server to push updates directly to the client as they happen. The client register a destination URL, and the server sends an HTTP POST request containing the event data.
Webhook Signature Verification
Because webhook endpoints are public, they must be protected. The server signs the request payload using a shared secret and adds a signature header (e.g. `X-Signature`). The receiver calculates the HMAC signature locally to verify the request is authentic.
JAVASCRIPT Snippet
javascript
const crypto = require('crypto');
const signature = crypto
.createHmac('sha256', secret)
.update(payload)
.digest('hex');