the polling vs postman analogy is a good one, gonna steal that for how I explain it to myself lol. I think I always technically knew webhooks were "event based" but never really got why that mattered until you laid out the cost angle, hammering an api on a schedule vs just waiting to get pinged makes way more sense now
the security section is what got me tho. I did not know people just leave webhook urls open like public endpoints, feels like such an obvious mistake once you say it but I probably would have done exactly that on my first attempt. the hmac verification part is a bit over my head right now but at least I know its a thing I need to go learn before I build anything real
quick q, for something small and low traffic is the secret token in the url enough or do people always go straight to signature verification even for tiny projects