Push vs Pull
| Pull (Polling) | Push (Webhook) |
|---|---|
| Client periodically asks | Server notifies |
| Wasted requests | Real-time |
Webhook Flow ⭐
1. User registers webhook URL 2. Event happens 3. Server POST event to URL 4. Receiver responds 2xx 5. Failure → retry with backoff
Webhook Payload
POST /webhooks/payment
X-Webhook-Signature: sha256=abc...
X-Webhook-Id: evt_xyz
X-Webhook-Timestamp: 1700000000
{"event":"payment.completed","data":{...}}
Webhook Security ⭐
// 1. HMAC verify
const sig = req.headers["x-webhook-signature"];
const expected = crypto.createHmac("sha256", SECRET)
.update(req.rawBody).digest("hex");
if (sig !== `sha256=${expected}`) return 401;
// 2. Timestamp (replay)
if (Date.now()/1000 - ts > 300) return 401;
// 3. Idempotency
if (await db.events.findById(req.headers["x-webhook-id"]))
return 200;
Retry Strategy
Exponential backoff: 1m, 5m, 30m, 2h, 12h, 24h। Max retry → DLQ + alert।
Receiver Best Practices
- Quick 2xx (queue work)
- Idempotent (same event = same result)
- Verify signature, log all events
Payment Gateway
Stripe
stripe.PaymentIntent.create(
amount=5000, currency="usd",
metadata={"order_id": "123"}
)
// Webhook
event = stripe.Webhook.construct_event(payload, sig, secret)
if event.type == "payment_intent.succeeded":
fulfill_order(event.data.object.metadata.order_id)
bKash
Create payment → Get URL → Redirect → Callback execute → Webhook update।
Email/SMS Service
- SendGrid, AWS SES, Mailgun, Postmark
- Twilio (global), SSL Wireless/REVE (BD)
API Mocking
Postman Mock, WireMock, Mockoon, MSW (frontend), nock (Node), Beeceptor।
Event Streaming
- Kafka — most popular
- AWS EventBridge — serverless
- Azure Event Grid/Hub
- Pulsar — multi-tenant
Webhook vs Stream
| Webhook | Event Stream |
|---|---|
| Per-subscriber HTTP | Pub/sub |
| Simple integration | High throughput |
| External 3rd party | Internal microservice |