Beginner LevelREST APIs & Web Services
How do Webhook HTTP Callbacks deliver real-time event notifications?
❓ Interview Prompt: Explain Webhooks, event-driven HTTP callbacks, provider POST notifications, HMAC signature verification (`X-Signature`), and idempotency.
Webhooks are automated HTTP 'POST' callbacks sent by a service provider to a client's server when an event occurs (e.g. Stripe payment succeeded):
Webhook Architecture:
1
Registration: Client registers a callback URL (e.g. 'https://my-app.com/api/webhooks/stripe').
2
Event Trigger: When an event occurs, provider sends an HTTP 'POST' request with JSON event payload.
3
HMAC Signature Verification: Receiver verifies 'X-Signature' header using a shared secret to ensure payload authenticity!
Code Implementation Example
typescript
import crypto from 'crypto';
export function verifyWebhookSignature(payload: string, signature: string, secret: string): boolean {
const expectedSignature = crypto
.createHmac('sha256', secret)
.update(payload)
.digest('hex');
return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature));
}💡Verifying HMAC webhook payload signatures in TypeScript.
🎯 Interview Key Takeaway
Webhooks deliver real-time event notifications via HTTP POST callbacks; receivers must verify HMAC signatures for security.
#Webhooks#HMAC#Event-Driven#Beginner
Back to all REST APIs & Web Services Questions→