What Is a Webhook URL?
A webhook URL is the single most important piece of any webhook setup — it's the address an event gets delivered to. Here's what one is, how to get one, and how to keep it safe.
The definition
A webhook URL is an HTTP(S) endpoint you give to a service so that, when an event happens, the service sends an HTTP request to that address. It's just a normal URL — https://yourapp.com/webhooks/stripe — but its job is to receive automated requests rather than serve a web page.
What makes a good webhook URL
- HTTPS, always. Webhook payloads often contain sensitive data. Providers increasingly require
https://. - Publicly reachable. The provider's servers must be able to connect to it — a
localhostURL won't work (see testing webhooks locally). - Stable. If the URL changes, you have to reconfigure every provider pointing at it.
- Hard to guess. The URL itself is a capability — anyone who knows it can send requests to it. A random path segment adds a layer of obscurity (though it's never a substitute for signature verification).
- Dedicated. Use a path that does nothing but handle webhooks, with no auth middleware in front of it that would block the provider.
How to get a webhook URL
There are three common ways:
- From a webhook tester — generate an instant public URL to capture and inspect requests. Best for testing and debugging.
- Your own deployed endpoint — a route in your application like
/webhooks/provider. Best for production. - A tunnel — a tool that exposes a local port publicly during development.
Webhook URL security
Because anyone who knows your webhook URL can POST to it, treat it as semi-secret — but never rely on secrecy. The real defence is signature verification: every request is signed, and your endpoint rejects anything that doesn't verify. Obscure URL plus signature verification is the right combination.
One URL, many providers?
You can point multiple providers at one URL, but it's usually cleaner to give each provider its own path (/webhooks/stripe, /webhooks/github). Each provider signs differently, so separate paths keep your verification logic simple.