Question 1

What is a webhook?

Accepted Answer

An HTTP request **sent by a service to you** when something happens — the inverse of an API call, and the reason it is sometimes described as a reverse API or a push notification for servers.

**The problem it solves.** Without webhooks, learning that something happened elsewhere means **polling**: asking repeatedly whether anything has changed. Polling is wasteful — almost every request returns nothing — and slow, since you learn about an event only at the next poll. A webhook delivers the event immediately, once.

**How it works.** You register a URL with the provider and specify which events you want. When one occurs, the provider sends an HTTP POST to your URL with a payload describing it. Your endpoint processes it and responds with a success status.

**What you must handle, and what people get wrong:**

**Verification.** Anyone can send a request to your URL. Providers sign payloads — typically an HMAC using a shared secret in a header — and **you must verify the signature**, computing it over the raw body before parsing. Failing to verify means accepting forged events, which for a payment webhook means accepting forged payments.

**Idempotency.** Webhooks are delivered **at least once**, not exactly once. Retries and network failures mean duplicates are normal. Store the event ID and ignore ones already processed — **this is not optional.**

**Ordering.** Events can arrive out of order. Use timestamps or sequence numbers rather than assuming.

**Respond quickly.** Acknowledge immediately and process asynchronously by placing the event on a queue. Providers time out, and a slow endpoint causes retries, which causes duplicates.

**Return the right status.** A non-2xx response triggers retry, usually with exponential backoff — and permanently failing endpoints are eventually disabled.

**Handle replay attacks** by rejecting payloads with old timestamps.

**For local development**, tunnelling tools expose a local endpoint to the internet, and most providers offer a way to replay past events.

**The alternatives:** polling, which is simple and adequate at low volume; **server-sent events** and **WebSockets** for browser clients; and message queues where both parties are yours.

Question 2

What is a WebSocket, and when do you actually need one?

Accepted Answer

A protocol providing a persistent, bidirectional connection between client and server over a single TCP connection — so the server can send data without being asked, which ordinary HTTP

Question 3

What is idempotency and why does it matter for APIs?

Accepted Answer

An operation is idempotent when performing it more than once has the same effect as performing it once. Setting a value to ten is idempotent; adding ten is not. The property matters because networks

Question 4

What makes a good API design?

Accepted Answer

Predictability above cleverness — a good API is one where a developer can guess correctly what something is called and how it behaves, because they will guess far more often than they will read the

Question 5

What is a message queue and when do you need one?

Accepted Answer

A message queue sits between a producer of work and a consumer of it, holding messages until they can be processed. It converts a synchronous call into an asynchronous one. What it gives you:

Question 6

Why am I getting a CORS error when calling my API from the browser?

Accepted Answer

The single most useful thing to understand about CORS is that it is enforced by the browser, not by your API. Your server almost certainly responded correctly. The browser made the request, inspected

Question 7

What is a JWT, and when should you not use one?

Accepted Answer

A JSON Web Token is a signed, self-contained token carrying claims — typically who the user is and when the token expires — which a server can verify without a database lookup. That property is its

Related Questions