The webhook URL: what it is and who should see it

The webhook URL is the address your receiving tool listens on. You copy it from one tool and paste it into another. Treat it as private.

What you need

• A receiving tool that makes webhook URLs, such as an automation platform.
• A sending app with a webhooks settings page.
• Somewhere private to hold the URL while you move it, not a shared chat or a public document.

Where the URL comes from

The receiving tool makes it. Zapier's Catch Hook trigger hands you one unique address for your trigger app to post to.¹ A POST request is the kind of message that carries data to an address.

Zapier's steps then say to paste the URL you copied into the sending app's webhook settings.¹

What the long string of letters is for

Parts of the address are made up by the tool. In n8n, the path field holds a randomly generated URL path by default, so one webhook doesn't clash with another.²

Zapier's URLs contain the owner's Zapier ID. They only change if the Zap moves to another user.¹ If that happens, you must update the URL in the sending app or the Zap won't trigger.¹

A tool can also give you more than one address. n8n has a test URL and a production URL for the same webhook node.² Paste the right one into the sending app, or you'll see nothing where you expect it.

Why you should keep it private

The vendors' pages don't say "never share this". What they do say points the same way.

• n8n lets you require authentication for any service that calls your webhook URL.²
• Wikipedia says the incoming POST request should be authenticated to avoid a spoofing attack.³ Spoofing means someone pretending to be the real sender.
• GitHub's advice is to use HTTPS for the receiving server.⁴

So the sensible habit is simple. Anyone who holds the address could try to send something to it. Keep it out of public pages, screenshots, shared spreadsheets and emails to people who don't need it. Check the receiving tool's own documentation for ways to require a secret or a login.

What not to put inside a URL

GitHub warns against including sensitive information in a payload URL, such as your own API keys or other credentials.⁴ It recommends a webhook secret instead, so the receiver can check a delivery was really sent by GitHub.

If a form asks you to build a webhook URL by hand, don't add passwords or keys to the end of it. Use the tool's own authentication option.

If a URL leaks

Check the receiving tool's documentation for how to replace it. With a new address, update every sending app that used the old one. Zapier says the same when its URL changes.¹

Your business may also have its own rules on who can hold integration addresses. Follow those first.

For what the message holds once it arrives, see what travels in the request itself. For the basics, start at the first page.