Webhooks flipped the API: instead of asking, apps get called when things happen

In 2007 websites had APIs, but integration still meant polling: one application knocked on another's door again and again to ask whether anything new had happened. Jeff Lindsay's blog post 'Web hooks to revolutionize the web' argued for the Unix pipes idea applied to the web — simple programs chaining together through input and output — by letting sites register callbacks that other sites would call when an event occurred.

The design is radical in its smallness: a webhook is a user-defined HTTP callback. You give the originating app a URL; when the event fires, it POSTs the data to you. No message broker, no new wire format, no new ports or certificates — just a request over the web everyone already runs. Each integration is one-to-one, so the network compounds without any central coordinator.

The pattern spread platform by platform. GitHub, Stripe, Shopify and Slack shipped webhook support, and by the 2010s an integration platform like Zapier could describe it as the default way apps 'speak' to each other — the push-email moment for applications, where software stopped checking and started receiving.

Don't call us — we'll call you, over plain HTTP

A webhook is one URL, so any app can offer one without new infrastructure

Push beats polling: no wasted requests and near-real-time delivery by default

It rides plain HTTP, so firewalls, proxies and TLS already work

One-to-one connections compound into a network without a central broker

The cheapest standard is the one that needs no new machinery. If you can express the new pattern in what everyone already runs — a URL, an HTTP POST — adoption takes care of itself.

Webhooks went from an outsider's idea to table stakes, and the simplicity created its own problems that the industry then standardized around: payloads are now signed (Stripe popularized HMAC signatures), consumers need retries and idempotency, and receivers that fetch attacker-supplied URLs became a classic server-side request forgery vector that OWASP documents at length. What began as a blog post is now how payments confirm, code deploys and chat apps ping.