---
title: "Discussion on \"Webhook Fundamentals: What They Are and How to Use Them\" | Hashnode"
description: "Discussion on \"Webhook Fundamentals: What They Are and How to Use Them\". A practical guide: webhook fundamentals: what they are and how to use them"
url: "https://hashnode.com/posts/webhook-fundamentals-what-they-are-and-how-to-use-them/69f5b05388ad32aaa6173862"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Webhook Fundamentals: What They Are and How to Use Them](https://chasebot.hashnode.dev/webhook-fundamentals-what-they-are-and-how-to-use-them?utm_source=hashnode&utm_medium=feed)

A practical guide: webhook fundamentals: what they are and how to use them

May 2 · 7 min read · chasebot.hashnode.dev  
Read the article

-   [#apis](https://hashnode.com/tag/apis)
-   [#automation](https://hashnode.com/tag/automation)
-   [#beginners](https://hashnode.com/tag/beginners)
-   [#web-development](https://hashnode.com/tag/web-development)

## Written by

[Raizan](https://hashnode.com/@chasebotdev)

@chasebotdev · Dubai, UAE

  
[View profile](https://hashnode.com/@chasebotdev)

Practical guides on n8n workflows, API automation, and self-hosted tools.

## Responses 1

Markdown supported · ⌘↵ to post

[Tarek Elzoghby | طارق الزغبي](https://hashnode.com/@Tarek-Elzoghby)

[Aug 24](https://hashnode.com/posts/webhook-fundamentals-what-they-are-and-how-to-use-them/69f5b05388ad32aaa6173862/comment/6a8c5025083872f70444630e)

the polling vs postman analogy is a good one, gonna steal that for how I explain it to myself lol. I think I always technically knew webhooks were "event based" but never really got why that mattered until you laid out the cost angle, hammering an api on a schedule vs just waiting to get pinged makes way more sense now

the security section is what got me tho. I did not know people just leave webhook urls open like public endpoints, feels like such an obvious mistake once you say it but I probably would have done exactly that on my first attempt. the hmac verification part is a bit over my head right now but at least I know its a thing I need to go learn before I build anything real

quick q, for something small and low traffic is the secret token in the url enough or do people always go straight to signature verification even for tiny projects