12 Practical Webhook Use Cases for Connecting Business Applications
Twelve event-driven workflows built on webhooks, from payment confirmations to signed contracts, and how to verify, deduplicate and reconcile them.
What are webhooks used for?
Webhooks let one application notify another the moment something happens, so the next step starts without anyone checking or re-typing. Common uses are confirming payments, syncing orders, filing signed contracts, routing form submissions, updating CRMs from bookings, alerting teams, triggering builds and keeping subscriptions in step with billing. To be dependable they need signature verification, fast acknowledgement, queued processing, deduplication and a reconciliation job.
This guide is for business owners, operations leads and developers connecting systems. It is not a list of integrations to buy (for that, see common website integrations); it is about event-driven workflows and how to make them reliable. Provider behaviour was checked in Stripe, Shopify, Razorpay and GitHub documentation on 28 October 2026. For the ecommerce-specific technical detail, see ecommerce webhooks.
How a webhook workflow works
You register an HTTPS URL with the sending service and choose which events you want. When an event happens, the service sends a POST request with a JSON payload and a signature header. Your endpoint verifies the signature, records the event, returns a 2xx response quickly and processes the work in the background. Stripe's documentation is explicit that you should return a successful status before complex logic that might time out, and recommends handling events through an asynchronous queue.
Payments and billing
1. Confirm payment before fulfilling. Do not rely on the customer's browser returning to a success page; it may close. Use the payment provider's success event (for example Stripe's payment_intent.succeeded or a Razorpay payment event) to mark the order paid and start fulfilment.
2. Handle failed and disputed payments. Events for failed renewals, refunds and disputes can pause access, notify the customer, open a task for finance or attach evidence. These often arrive days after the original payment.
3. Keep subscription access in step with billing. Renewal, cancellation and plan-change events update what the customer can use in your app, so access never depends on someone remembering to change it. See payment gateway integration.
Sales and customer data
4. Website form to CRM. A form or form-builder webhook creates or updates the lead in the CRM, assigns an owner and starts follow-up, with the source page attached. See CRM website integration.
5. Booking to CRM and calendar. When a meeting is booked, rescheduled or cancelled, the scheduling tool's webhook updates the CRM record and notifies the account owner.
6. Signed contract to the next step. When an e-signature platform reports a document as completed, the deal is marked won, the signed copy is filed and onboarding or invoicing begins.
Commerce and operations
7. Store orders to fulfilment and accounting. Shopify and other platforms send order and fulfilment events that can create shipments with a 3PL, update the ERP or post sales to accounting. Shopify notes that it does not guarantee ordering within a topic and that delivery is not always guaranteed, so it recommends reconciliation jobs.
8. Inventory and catalogue sync. Product and inventory update events keep marketplaces, search indexes and product feeds aligned with the source system.
9. Shipping and delivery updates. Carrier tracking webhooks update the order status and trigger customer notifications, rather than polling every carrier on a schedule.
Internal tools and engineering
10. Alerts into team chat. Events such as a large order, a failed payment, an urgent support ticket or a failed integration post a message to the right Slack or Teams channel. Alert only on things someone must act on.
11. Code and deployment events. GitHub and similar platforms send events for pushes, pull requests and releases that can trigger builds, previews and deployment notifications. GitHub's documentation notes that it does not automatically redeliver failed deliveries, so failures need monitoring or scripted redelivery.
12. Triggering AI and automation workflows. A new support ticket, email or uploaded document can trigger an automation that classifies it, extracts data or drafts a reply, with approval before anything is sent. See APIs, webhooks, MCP or RPA.
Connecting systems that keep falling out of sync?
ZSpace Labs builds integrations with signature verification, queues, retries, monitoring and reconciliation. See our web application development and workflow automation services.
Use case table
| Use case | Typical event | Action | Must not happen |
|---|---|---|---|
| Confirm payment | Payment succeeded | Mark paid, start fulfilment | Fulfilling twice |
| Failed or disputed payment | Payment failed, dispute opened | Pause access, notify, open task | Missed dispute deadline |
| Subscription access | Renewed, cancelled, changed | Update entitlements | Access out of step with billing |
| Form to CRM | Form submitted | Create lead, assign, follow up | Duplicate leads |
| Booking to CRM | Booked, rescheduled, cancelled | Update record, notify owner | Stale meeting times |
| Signed contract | Envelope completed | Mark won, file, start onboarding | Lost signed copy |
| Orders to fulfilment | Order created or paid | Create shipment, post to ERP | Missed or duplicate shipments |
| Inventory sync | Inventory updated | Update channels and feeds | Overselling |
| Delivery updates | Tracking status changed | Update order, notify customer | Wrong status shown |
| Team alerts | Threshold or failure event | Post to channel | Alert fatigue |
| Code and deploy | Push, PR, release | Build, preview, notify | Unverified triggers |
| AI workflows | Ticket, email or file created | Classify, extract, draft | Unreviewed outbound actions |
Making webhook workflows reliable
These practices come from the providers' own documentation and apply to every use case above.
- Verify the signature on the raw body. Stripe signs with HMAC-SHA256 in the Stripe-Signature header; Shopify sends X-Shopify-Hmac-Sha256; Razorpay sends X-Razorpay-Signature. Both Stripe and Razorpay warn that parsing or changing the body before verification breaks it.
- Reject stale events. Stripe includes a timestamp in the signature, and its libraries default to a five-minute tolerance to limit replay attacks.
- Acknowledge fast, process later. Return 2xx after verifying and storing the event; do the work from a queue.
- Deduplicate. Providers can send the same event more than once. Record event IDs (Stripe's event ID, Shopify's X-Shopify-Webhook-Id, Razorpay's x-razorpay-event-id) and skip ones already processed.
- Do not assume order. Stripe, Shopify and Razorpay all say events can arrive out of order. Fetch the current state through the API, or compare timestamps, before acting.
- Know each provider's retry policy. Stripe retries for up to three days in live mode; GitHub does not retry automatically. Design for the weakest provider you depend on.
- Reconcile on a schedule. Run a periodic job that compares recent records through the API to catch missed events.
- Monitor and alert. Track failed verifications, processing errors and queue age, and alert a person when they rise.
- Protect secrets. Store signing secrets securely and rotate them; Stripe lets an old and new secret overlap for up to 24 hours.
Worth noting
Standard Webhooks is an open-source set of guidelines and libraries for sending webhooks consistently. If you are building a product that sends webhooks to others, it is worth reading before you design your own format.
When not to use a webhook
Use a scheduled API sync instead when the source system does not offer webhooks for the events you need, when you need a complete daily snapshot rather than individual changes, or when event volume is so high that batch processing is simpler. Many reliable integrations use both: webhooks for speed and a scheduled sync as a safety net. For the wider choice between APIs, events and queues, see integration architecture patterns.
Conclusion
Webhooks are the simplest way to make one system react to another the moment something happens, from confirming payments to filing contracts. The workflows are easy to sketch and easy to get subtly wrong, so verify signatures, acknowledge quickly, process from a queue, deduplicate, ignore ordering assumptions and reconcile. For securing the APIs on both sides, see API security best practices.
Sources
Stripe documentation, receive Stripe events in your webhook endpoint (signatures, retries, ordering, duplicates). Shopify developer documentation, webhooks (HMAC header, webhook ID, ordering, reconciliation). Razorpay documentation, validate and test webhooks. GitHub Docs, handling failed webhook deliveries. Standard Webhooks project site. Accessed 28 October 2026.
Common questions.
An HTTP request that one application sends to a URL you provide when something happens, such as a payment succeeding. Instead of your system repeatedly asking "has anything changed?", the other system tells you when it does.