Webhooks for Builders
Webhooks are how modern APIs push data to your application — Stripe payments, GitHub push events, Clerk authentication events, Twilio SMS receipts. This course teaches you how to receive, verify, and reliably process webhook payloads in Next.js, including the patterns that prevent duplicate processing and missed events.
What you'll learn
Course outline
Free — start now
What Are Webhooks?
Webhooks vs polling: how real-time APIs actually work
Your First Webhook Receiver in Next.js
Route Handler with POST, reading raw body, returning 200 quickly, async processing
Signature Verification: The Step Everyone Skips
HMAC-SHA256, timing-safe compare, why raw body matters, Stripe's stripe-signature header
Full course — $39 one-time
Stripe Webhooks: Payments, Subscriptions, and Failures
Stripe event types, checkout.session.completed, invoice.payment_failed, subscription lifecycle
Idempotency: Handling Duplicate Delivery Gracefully
Why webhooks deliver more than once, idempotency keys, storing event IDs, database upsert patterns
Retry Queues and Failure Recovery
Exponential backoff, dead letter concepts, storing failed events, manual replay, webhook dashboards
Testing Webhooks Locally with ngrok and the Stripe CLI
ngrok setup, Stripe CLI stripe listen, webhook.site for any provider, local HTTPS
Debugging Webhooks: Logs, Replays, and Common Mistakes
Stripe dashboard event logs, raw body errors, 500 responses causing re-delivery, timeout issues
Building Your Own Webhook System for Customers
URL registration, event queue, signature generation, retry on failure, webhook management UI patterns
Get the full course
All 9 lessons. Stripe, idempotency, retry logic — the patterns that make webhook integrations production-ready.
Written by the RadarTrek editorial team · Reviewed June 2026
About this course
Webhooks are the mechanism modern APIs use to push real-time data to your application — rather than your code repeatedly polling an endpoint to check for changes, the external service sends an HTTP POST to your URL the moment something happens. Stripe fires a webhook when a payment succeeds or a subscription renews. GitHub fires a webhook when a pull request is opened or merged. Clerk fires a webhook when a user signs up. Twilio fires a webhook when an SMS arrives. In 2026, virtually every production SaaS integration you build will involve receiving, verifying, and reliably processing webhook payloads. Getting webhooks wrong — missing the signature verification step, not returning 200 fast enough, or failing to handle duplicate delivery — leads to silent failures, security vulnerabilities, and missed events that are hard to debug.
This course covers the full webhook integration lifecycle in Next.js: setting up a Route Handler to receive POST requests, reading the raw body (which many tutorials get wrong), verifying HMAC-SHA256 signatures to reject forged events, processing Stripe's payment and subscription lifecycle events, implementing idempotency to handle the duplicate delivery that every webhook provider guarantees, and testing locally with ngrok or the Stripe CLI. The final lesson covers building your own outbound webhook system for customers — the other side of the equation that most builders eventually need.
Frequently asked questions
What is a webhook and how is it different from an API?
A regular API is pull-based: your code makes a request to an endpoint and gets a response. A webhook is push-based: when something happens on the provider's side (a payment, a user signup, a repository push), the provider sends an HTTP POST request to a URL you register. Webhooks eliminate the need for polling loops and enable real-time reactions to external events without your server having to constantly ask "has anything changed?"
How do I test webhooks during local development?
Webhook providers cannot reach localhost directly, so you need a tunnel. ngrok is the most widely used tool — it creates a public HTTPS URL that forwards to your local port. Run `ngrok http 3000`, then use the generated URL as your webhook endpoint in the provider's dashboard. The Stripe CLI offers a more integrated option with `stripe listen --forward-to localhost:3000/api/webhooks/stripe` — it also lets you replay events and trigger specific webhook types without real transactions.
What is webhook signature verification and why is it important?
When a webhook provider sends a POST to your endpoint, anyone could send the same POST pretending to be that provider. Signature verification proves the request genuinely came from the provider and has not been tampered with. The provider includes an HMAC-SHA256 hash of the raw request body (computed with a shared secret) in a header. Your endpoint recomputes the hash from the raw body using the same secret and compares the two — a mismatch means the request is rejected before any processing occurs. Skipping this step is a serious security vulnerability.
What does idempotency mean in the context of webhooks?
Every webhook provider guarantees at-least-once delivery — which means the same event may be delivered multiple times if the provider does not receive a timely 200 response. Idempotency means processing the same event twice produces the same result as processing it once. The standard implementation is to store the event ID in your database the first time you process it, and skip processing (returning 200 immediately) on subsequent deliveries of the same ID. Without idempotency, duplicate events can charge customers twice, create duplicate database records, or send multiple emails.
Which services use webhooks that I will likely need to integrate?
The most common webhook integrations for SaaS builders are: Stripe (payment success, subscription renewal, failed payments, refunds), Clerk (user created, email verified, session ended), GitHub (push, pull request, issue), Twilio (SMS received, call status), Resend/SendGrid (email delivered, bounced, complained), and Svix or Hookdeck if you use a webhook gateway. Most third-party services — Shopify, HubSpot, Notion — also expose webhooks. This course focuses on Stripe as the primary example since payment webhook handling is the most critical to get right.