# What is a webhook? A plain guide for small businesses

> A webhook is a message one app sends another the moment something happens, like a new lead. How webhooks work, how to check them and how to use them.

Source: https://roughfigure.com/blog/what-is-a-webhook (updated 2026-11-11)

A webhook is a message one app sends to another **the moment something happens**. Instead of your CRM asking your website every few minutes “any new leads?”, the website calls the CRM’s web address straight away with the lead’s details. It’s faster, and nothing is missed between checks.

## How a webhook works, step by step

1. **You give the sending app a web address** (a URL) that belongs to the app receiving the data, such as a Zapier “Catch Hook”, your developer’s server or your CRM’s inbound address.
2. **You choose the events.** New lead, lead changed, booking made.
3. **When the event happens**, the sender makes an HTTPS `POST` to that address with the details as JSON.
4. **The receiver replies `200 OK`** to say “got it”. If it doesn’t, a good sender tries again later.

A new-lead webhook might carry something like this:

```json
{
  "event": "lead.created",
  "data": {
    "name": "Priya Shah",
    "email": "priya.shah@mail.test",
    "service": "Driveway resin bound, about 60 m²",
    "estimate": { "low": 4800, "high": 6200, "currency": "GBP" }
  }
}
```

## How to know a webhook is genuine

Anyone who learns the address could post fake leads to it. Good webhook senders **sign** each message: they use a secret only you and they know to make a code (an HMAC) from the message, and put it in a header. Your receiver makes the same code and checks they match.

Do three things when you receive one:

- **Check the signature** against the raw body, before reading the JSON.
- **Check the timestamp** in the signature, and refuse anything older than a few minutes, so an old message can’t be replayed.
- **Ignore repeats.** A retry carries the same delivery ID. If you’ve seen it, reply 200 and do nothing.

## Webhook vs API

An **API** is a set of doors you knock on when you want something (“give me today’s leads”). A **webhook** is the other app knocking on your door when something happens. Most integrations use both: a webhook to say “new lead”, and the API to fetch more or update it.

## Webhook vs Zapier

Zapier often uses webhooks under the hood. If you want no-code, point the webhook at a Zapier Catch Hook. If you have a developer, point it at your own code and skip the per-task cost. [Zapier vs native integrations](https://roughfigure.com/blog/zapier-vs-native-integrations) compares the options.

## Doing it in RoughFigure

In RoughFigure we’ve built signed webhooks in on the Pro plan. Under **Integrations → Webhooks**, add your address and tick the events: **lead.created**, **lead.updated** and **booking.created**. Each message carries `RoughFigure-Event`, `RoughFigure-Delivery` (the same on every retry) and `RoughFigure-Signature` (a timestamp plus an HMAC-SHA256 of the body). We retry for about four hours if your system is down, and keep a delivery log you can resend from. [Read the webhooks guide](https://roughfigure.com/help/zapier-webhooks-api).

## Questions

### Do I need a developer to use webhooks?

Not if you send them to Zapier, Make or a CRM that accepts them. You need a developer to write your own receiver.

### What happens if my server is down when a webhook is sent?

A well-built sender retries with growing gaps, for hours. Check your sender’s delivery log for anything that never got through.

### Are webhooks secure?

They travel over HTTPS, and signed webhooks let you prove who sent them. Never trust an unsigned webhook that can create or change records.