Become an affiliateStart your program

Technology and tracking

Webhook

Also called HTTP callback, server callback.

Short answer

A webhook is an automatic HTTP call one system sends to another when an event occurs – for example an order being completed. The recipient records the event without having to ask. In affiliate tracking, webhooks are used to report sales server-to-server, independently of the customer's browser.

Definition of Webhook.

Technically, a webhook is a URL the recipient makes available, which the sender calls with an HTTP POST when something happens. Payment systems such as Stripe and platforms such as Shopify send webhooks for orders, refunds and subscription renewals. The content is structured data – order ID, amount, currency – that the recipient can process automatically at the moment the event happens.

In affiliate tracking, webhooks solve the browser's weakness. A pixel or a script can be blocked by ad blockers, tracking prevention or missing consent – but a webhook is sent from the store's systems and reaches the network's server whatever happened in the customer's browser. The order is reported with its order ID, so the conversion can be recorded and deduplicated even when the client side failed. It is the foundation of server-to-server tracking.

Security lies in signing. The sender signs every call with a shared secret – a signing secret – and the recipient rejects calls with an invalid signature. Without that check, anyone who knows the URL could send fake orders. A robust recipient verifies the signature, tolerates repeated deliveries of the same event and responds quickly, so the sender does not give up on the delivery.

Webhook vs. API call

AspectWebhookAPI call
Directionthe sender pushes data out when the event happensthe recipient fetches data when it asks
Initiativewith the system where the event happenswith the system that needs an answer
Delayat the eventat the next request – the polling interval
Use in affiliate marketingreporting orders, refunds and subscription renewalsfetching reports and product data, looking up status

Webhooks when events must be reported the moment they happen – API calls when you want to look something up on your own initiative.

How it goes wrong

  • 01

    No signature check

    A webhook URL without signature verification is an open door: anyone who knows the address can post a fake order and trigger commission. Checking the signing secret is not optional.

  • 02

    Same event, several deliveries

    Webhooks are delivered on an at-least-once basis – the sender sends again if it does not get an answer in time. Without deduplication on order ID, one sale becomes 2 commissions.

  • 03

    Silent failures

    If reception fails for a period, no one notices without monitoring – the sales are simply missing. Monitor that events actually come in, and have a plan for recording the gaps afterwards.

At Affilyflow

Webhook in practice

Affilyflow receives conversions server-to-server from Stripe via webhooks and from the WooCommerce plugin; the Shopify app, by contrast, reports sales with a Web Pixel in the browser. The Stripe integration only requires a webhook signing secret – we never ask for your Stripe API key, which would give access to your account. A store's webhook can only credit the store's own program.

The same order can never count twice – orders are deduplicated on order and invoice ID per program. If a Stripe payment is refunded or disputed, or a WooCommerce order is refunded, the commission is rejected automatically and the affiliate is notified. That automation does not exist on Shopify, where the store rejects the sale itself within the approval period.

Frequently asked questions

What is the difference between a webhook and an API?

The direction. An API answers when you ask; a webhook sends a message by itself when something happens. In practice both are used: the webhook reports the event immediately, and the API is used for lookups and reports on your own initiative.

Why does affiliate tracking use webhooks instead of only a pixel?

Because a pixel depends on the customer's browser, where ad blockers, tracking prevention and missing consent can stop it. A webhook is sent from the store's own systems directly to the network's server and reports the order with its order ID, whatever happened in the browser.

Is it safe to give an affiliate network a webhook?

Yes, when it is set up correctly. A webhook only makes it possible to receive the events the sender chooses to send – it gives no access to the system behind it. The calls should be signed with a signing secret, so the recipient can reject anything that does not provably come from the sender. A network should never ask for your API key in order to receive orders.

What is a webhook signing secret?

A shared secret the sender uses to sign every webhook call, typically as an HMAC signature in a header. The recipient calculates the same signature and rejects the call if they do not match. That proves the call comes from the right sender and has not been altered along the way.

Read on