Glossary · Triggers & webhooks
Webhook
Also called: web hook, HTTP callback, reverse API
A webhook is an HTTP request that one system sends to a URL you give it, automatically, the moment an event happens, so the receiver doesn't have to keep asking.
An API call is you asking a system for something. A webhook is the system telling you, unprompted. You register a URL with the sender ("POST to this address whenever an order is created"), and from then on every matching event arrives as a request with a JSON body describing it.
A concrete example
A form tool is configured with a webhook URL. When someone submits the form, the tool sends:
POST /hooks/abc123
Content-Type: application/json
{ "event": "form.submitted", "email": "ada@example.com", "company": "Example Ltd" }The receiver answers 200 quickly, then does the real work (score the lead, create the CRM contact) in the background. Answering fast matters: most senders time out after a few seconds and retry, which is how one event turns into two.
What goes wrong
- Anyone can call the URL. A webhook endpoint is public by design, so it needs authentication: a shared secret in a header, an HMAC signature of the body, or both.
- Retries create duplicates. Senders retry on timeouts and errors. Receivers should treat the event id, or an idempotency key, as "already handled".
- Order isn't guaranteed. An "updated" event can arrive before the "created" one. Don't assume sequence; re-read the record if order matters.
Webhooks beat polling on speed and cost, but only if the sender supports them and you handle the three problems above.
In Fluxo Flow
Every workflow can start from a Webhook trigger with a fixed URL. You choose how callers prove who they are: a shared secret in the x-fluxo-secret header, an HMAC-SHA256 signature of the raw body in x-fluxo-signature, or both, plus an optional IP allowlist and required headers. Bodies up to 256 KB are accepted, unauthenticated requests are rejected before a run starts, and an Idempotency-Key header is honoured for 24 hours so a retried delivery doesn't run twice. Going the other way, the REST API sends signed outbound webhooks when runs finish, fail or wait for review.
Read next
Related terms
- HMAC signatureAn HMAC signature is a hash of a message computed with a secret key that only the sender and receiver know, sent alongside the message so the receiver can prove it came from the sender and wasn't altered.
- Polling vs webhooksPolling means your system asks another system for new data on a fixed schedule; webhooks mean the other system pushes each event to you the moment it happens.
- Idempotency keyAn idempotency key is a unique value a client sends with a request so that, if the same request is retried, the server recognizes it and returns the original result instead of doing the work a second time.
- TriggerA trigger is the event that starts a workflow run: a person pressing Run, a schedule coming due, a webhook arriving, or a new record or event in a connected app.
- White labelWhite-label software is a product built by one company that another company resells under its own brand, name and domain, with the original vendor hidden from the end customer.