What is a webhook?
Webhooks are how a form fill becomes a CRM contact, a booking and a sales alert in seconds. When they break quietly, leads go missing and nobody knows until the pipeline report looks thin.
How webhooks work
A webhook has three parts: an event, a payload and an endpoint. You tell the sending app, “when this event happens, send the details to this URL.” When a buyer submits your quote form, the form tool sends a small JSON payload with their name, email, company and answers to your endpoint. Your endpoint responds with a success code, and the work starts.
Webhooks vs. APIs and polling
An API is a door you knock on. Your system calls it to ask for data or make a change. Polling means knocking on a schedule, say every 15 minutes: “any new leads?” Most of those calls come back empty, and each one counts against API rate limits.
A webhook flips the direction. The source system calls you, once, when something happens. Most integrations use both: a webhook announces the event, and an API call fetches the full record or writes it to the CRM.
Six parts of a webhook you can trust
Signatures
The sender signs each payload with a shared secret. Your endpoint recomputes the signature and rejects anything that fails, which blocks forged leads.
Fast acknowledgment
Reply with a success code right away, then do the slow work in the background. Slow replies look like failures to the sender.
Retries
Most senders retry failed deliveries on a backoff schedule. Your side should also retry its own downstream calls, like the write to the CRM.
Idempotency
Retries mean the same event can arrive twice. Idempotency keys, usually the event ID, make the second copy a no-op so you never create duplicate contacts.
Dead-letter queues
After the last retry, the message goes to a dead-letter queue with an alert, so a person can fix and replay it.
Logging
Store every payload received and every result. When sales asks where a lead went, you can answer in minutes.
How webhooks connect forms, CRM and booking tools
In a typical B2B lead flow, the website form fires a webhook. The endpoint verifies it, checks for an existing contact, then creates or updates the contact and deal in HubSpot. A second step books a meeting slot or creates an event in the booking system, and a third posts an alert for the assigned rep. Lead routing rules decide who gets it.
The reverse direction matters too. HubSpot can fire its own webhooks when a deal stage changes, which lets you send closed-won events back to ad platforms and close the loop between marketing spend and revenue. That is the data attribution for AI search depends on.
We build these flows as part of our CRM and tech integrations work, usually alongside a website build so forms, tracking and CRM are designed together.
From our work
We have shipped 9 HubSpot–Tripleseat integrations for event venues and private members’ clubs, including a multi-location members’ club and event venue in New York and Washington, DC. Event inquiries and bookings move between the two systems as they happen.
The safety rules come straight from the patterns above. Clients connect with OAuth 2.0, so nobody shares a password. We host the integration, so the client runs no servers of their own. We never edit or delete Tripleseat documents or contracts. Failure alerts are monitored by our team. The “Tripleseat Integration by AlchemyLeads” HubSpot app is in early access. More client results are on our reviews page.
Webhook launch checklist
- Endpoint uses HTTPS and verifies the signature on every request.
- Success code returned within a few seconds; heavy work queued.
- Event ID stored and checked so duplicates are ignored.
- Retries with backoff on every downstream write.
- Dead-letter queue with an alert to a named owner.
- A test lead submitted end to end before launch, and again after any form change.
Related terms
- CRM integration: the wider connection webhooks are one part of.
- Two-way sync: keeping records matched in both directions.
- Lead push: sending new leads from one system into another.
- Data deduplication: the cleanup idempotency helps you avoid.
Frequently asked questions
What is the difference between a webhook and an API?
With an API, your system asks another system for data when it chooses. With a webhook, the other system tells you the moment an event happens. Webhooks are push; API calls are pull.
Are webhooks secure?
They can be. Use HTTPS, verify the signature on every payload, keep the shared secret out of your code, and reject requests that fail the check or arrive with stale timestamps.
What happens if a webhook fails?
Most senders retry on a schedule. If every retry fails, a well-built receiver moves the message to a dead-letter queue and alerts someone, who fixes the cause and replays it.
Does HubSpot support webhooks?
Yes. HubSpot can send webhooks from workflows and apps when records change, and it can receive data from webhooks through its APIs and workflow actions, depending on your plan.
Every lead, in the CRM, on time
We connect forms, CRM and booking tools so the buyers AI search and SEO send you reach sales in seconds and show up in revenue reporting.
