A new order from an online store, a filled-out form on your website, a payment from a payment gateway - here's how to connect events like these into your system through a webhook, and how to let data out the other way through an API.
An online store, a website or a payment gateway usually run as separate systems that don't know about each other - until someone manually connects them by copying data. Webhooks and API solve exactly this: they let two systems send each other data automatically, the moment something happens, without a single manual step in between.
Two directions of connection
Webhook - data comes in. An external service (online store, payment gateway, website form) calls your address on a certain event and sends data. The automation receives the webhook and runs further steps based on it - for example, creating a new record.
API - data goes out. In the opposite direction, using an API key, an external system can reach into your data itself - for example to pull the current status of an order, or write a result back.
Most real-world connections combine both directions: the website sends a new order in through a webhook, and later asks through the API what status it's in.
A webhook receives data from anywhere and triggers an automation.
The online store or website calls the webhook on every new order, the automation receives the data and creates the matching record right away.
The typical steps for connecting an online store
- You create a webhook in your automation - you get a unique address that the external system sends data to.
- You enter this address into the online store's, payment gateway's or form's settings as the place event notifications should be sent.
- You map fields from the incoming data (name, email, order line items) onto columns in your database.
- You add follow-up steps - creating a record, sending a confirmation, assigning it to the responsible person.
When an API key fits better than a webhook
A webhook is suited to reacting to a one-off event. An API key fits where you need to read or write data from outside on a regular basis or on demand - for example an internal tool that checks for new records once an hour, or external reporting that pulls the current numbers.
What to watch out for
Verifying the source of the data. A webhook should only accept data from a trusted source - this is commonly handled with a secret key that the sender includes, which the automation verifies before processing the data.
Missing or incomplete data. Not every incoming request will have all fields filled in - the automation should have a condition for the case where a required value is missing, instead of quietly creating an incomplete record.
Volume of requests. If the online store generates hundreds of orders a day, it's worth planning from the start for the automation to run often, and building in a duplicate check.
When connecting through an external scenario makes sense and when automation is better placed inside the system is covered in Are Zapier and Make dead?.
Frequently asked questions about webhooks and API
Do I need a developer to connect a webhook to my online store?
For most common e-commerce platforms it's enough to copy the webhook address into the notification settings - the field mapping and the follow-up steps are put together visually, without writing code.
How do I know whether to use a webhook or an API key?
Use a webhook when you want to react to a specific event (a new order, a payment). Use an API key when you need to read or write data as needed, not just in reaction to a single event.
What if the external system sends data in a format that doesn't match my database?
Between receiving the webhook and creating the record, you can insert a step that remaps or transforms the data into the right shape before it's written.