What Is a Webhook and How to Use It in No-Code Tools

Webhooks in plain terms

A webhook is an HTTP request an app sends to your address when something happens: a form is submitted, an order is paid, a deal changes status.

Compare two approaches:

• Polling — every few minutes you ask the app, "Any new leads?" Most of the time the answer is no, and the reaction is delayed.
• Webhook — the app tells you, "Here is a new lead." The reaction is near-instant and there are no wasted checks.

What a payload looks like

A webhook usually arrives as a POST request with a JSON body, called the payload:

{
  "event": "form.submitted",
  "created_at": "2026-05-12T09:30:00Z",
  "data": {
    "name": "Alisher",
    "phone": "+998901234567",
    "source": "landing"
  }
}

Headers matter too: they often carry the event type, a signature or a token for verifying the sender. Look up the exact payload structure in each app's webhook documentation.

Catching a webhook in Zapier, Make and n8n

Zapier

1. Create a Zap with the Webhooks by Zapier trigger → Catch Hook.
2. Copy the URL it gives you into the source app's settings.
3. Send a test event and click Test trigger — Zapier shows the fields it received.

Webhooks by Zapier is not available on every plan.

Make

1. Add a Webhooks → Custom webhook module and create a new webhook.
2. Copy its address into the source app.
3. Send a test event and Make detects the data structure automatically. If the fields change later, use Redetermine data structure.

n8n

1. Add a Webhook node and choose the method (usually POST).
2. The node has two addresses: the Test URL works while you have clicked Listen for test event, and the Production URL works once the workflow is activated.
3. A common mistake is leaving the test address in the source app. Swap it for the production one after activation.

How to test

• Start with a real event from the app: hand-made test data may have a different structure.
• If the app is not ready yet, send a request yourself with Postman or curl:

curl -X POST "https://example.com/webhook/abc123" \
  -H "Content-Type: application/json" \
  -d '{"name":"Test","phone":"+998900000000"}'

• Check edge cases: empty fields, long text, non-Latin characters.
• See how the app handles failures: many resend a webhook if they do not get a success response. That means one event can arrive twice, so build in a duplicate check.

How to secure a webhook URL

A webhook URL is effectively an open door: anyone who knows it can send data to it.

• Do not expose the address in frontend code, screenshots or public documents.
• Check a secret. Many apps let you set a token that arrives in a header. The n8n Webhook node has built-in authentication (Header, Basic, JWT); in Zapier and Make you can check it with a filter on the header or a field.
• Verify the signature (HMAC) if the app sends one: it proves the request came from that app and was not altered.
• Drop junk: discard requests missing required fields.
• Rotate the address if it leaks, and update it in the source app.