Webhooks
maang.io System Design Series
A webhook flips the API around: instead of a client polling for changes, the server POSTs to a URL you registered whenever an event happens. That efficiency comes with hard problems — retries and at-least-once delivery (so you need idempotency), ordering, and security (HMAC signatures, replay and SSRF protection). It's the glue behind third-party integrations everywhere.
This deep dive comes in three parts:
- Foundations & Core Concepts — callbacks vs polling and the event-driven flow.
- Internals — retries/backoff, idempotency keys, signature verification, and scaling delivery, with worked examples.
- Interview — Staff/Principal Q&A: reliable delivery, security, and webhooks vs polling/websockets.