Webhook-Based Workflows

A webhook is an HTTP callback — when something happens in System A, it sends an HTTP POST to a URL you've configured in System B. This is the foundation of event-driven architecture and the mechanism behind almost every modern integration. Examples relevant to your stack: Stripe sends a webhook when a subscription is created, updated, or cancelled — your app listens for these events and updates the customer's access. Apple's App Store sends server-to-server notifications (S2S) for subscription events — same pattern. A Dormakaba door access event could be a webhook to your app. GitHub sends webhooks on pull requests — your CI/CD pipeline starts. Webhook receivers must be: fast (respond within 5 seconds or the sender retries), idempotent (if the same event arrives twice, processing it twice doesn't cause problems), and authenticated (verify the webhook signature to prevent spoofed events). Every major webhook provider uses HMAC signature verification — validate the signature on every incoming webhook before processing it.

The most common mistake with webhooks is processing them synchronously in the HTTP handler — you acknowledge the webhook, then do the work, and if the work takes too long, the sender times out and retries, creating duplicate processing. The correct pattern: (1) Receive webhook and verify signature (< 100ms), (2) Save the raw event to a queue or database immediately, (3) Return 200 immediately, (4) Process the event asynchronously in the background. This ensures no events are lost and the sender never sees timeouts. For Darkice Interactive's integration with Gliderol or Dormakaba: an access control event (door opened, access denied, battery low) comes via webhook. Your receiver saves it to a Supabase table, returns 200, and then a Supabase database webhook triggers an n8n workflow that: (a) classifies the event type, (b) checks if it's alertable, (c) notifies the relevant contacts via WhatsApp/email if needed. This entire pipeline handles hundreds of events per second with no server management and costs cents per day.