How do I use webhooks?

What a webhook is, in practice

A webhook is the reverse of a normal API call: instead of your app asking a service for data, the service pushes data to a URL you provide whenever an event happens (a payment clears, a form is submitted elsewhere, a booking is made). Your Lovable app needs an endpoint ready to receive that push.

Setting one up

1. Ask Lovable to create a server function that will act as the webhook receiver:

"Create a server function at a public URL that accepts POST requests from Stripe and updates the matching order's status in my database."

2. Copy the resulting function URL.
3. Paste that URL into the third-party service's webhook settings (Stripe, Calendly, a CRM, etc.).
4. Trigger a test event from that service and confirm the function received it — check Lovable Cloud's function logs.

Verifying the sender

Most providers sign their webhook payloads (a signature header) so you can confirm the request really came from them and wasn't spoofed. Ask Lovable to verify this signature using the provider's shared secret, stored server-side:

"Verify the Stripe webhook signature using my Stripe webhook secret before processing the event."

What usually goes wrong

• Skipping signature verification, which lets anyone who finds the URL send fake events.
• The endpoint taking too long to respond — most providers expect a fast 200 response and will retry (and eventually give up) if it hangs; do slow work asynchronously after acknowledging receipt.
• Not handling duplicate deliveries — providers often retry, so make the handler safe to run twice on the same event (check if you've already processed that event ID).
• Testing only in preview and then finding the webhook URL changes or isn't reachable in production — see /questions/why-is-my-api-working-in-preview-but-not-production.

For receiving structured incoming data specifically, see /questions/how-do-i-receive-webhook-data.