What Is a Webhook? How sona.to Webhooks Work

A webhook is a message one app sends to another the moment something happens, so the second app does not have to keep asking. You give the first app an address, and it sends the details of each event there as soon as it occurs. This guide explains how webhooks work, how to check that a webhook is genuine and what sona.to sends, also summed up on the webhooks page.

What is a webhook?

Most apps share data in two ways. With an API, your system asks: "has the post been published yet?", and asks again later if the answer is no. With a webhook, the app tells you: when the post is published, it sends a request to an address you chose, with the details of the post.

A webhook is therefore an HTTP request, usually a POST with a JSON body, sent to a URL you control. That URL can be your own server, or a webhook address given by n8n, Zapier, Make, Slack or another service that starts a workflow when the request arrives.

Webhook vs API

An API is for asking and changing: list posts, create a post, read figures. A webhook is for being told. Most integrations use both: the API to create a post and a webhook to learn when it was published or failed. Asking an API again and again wastes requests and still finds out late, while a webhook arrives as soon as the event happens.

How to verify a webhook

Anyone who knows your webhook address could send a fake request to it, so a well-made webhook is signed. The sender computes a signature from the body and a shared secret, usually with HMAC SHA-256, and puts it in a header. Your side computes the same signature with the same secret and compares the two with a constant-time comparison. If they differ, the request is ignored.

Including a timestamp in the signed data also stops replays: a request captured once cannot be sent again later, because its timestamp is too old.

Webhooks in sona.to

sona.to sends webhooks for four events: a post was published, a post failed, a site audit finished and a site audit failed. You choose which events each webhook receives, so a chat notifier can listen only for failures while a reporting sheet takes everything. The payload uses the same field names as the sona.to API.

Setting one up. On the API page of your dashboard, paste the address, tick the events and save. The signing secret is shown once at that moment, so copy it then.

Signature. Every delivery carries a header with a timestamp and an HMAC SHA-256 of the timestamp and the body, made with your secret. Reject requests whose timestamp is more than a few minutes old.

Retries. If your address is down or returns an error, the delivery is tried again after 60 seconds, 5 minutes and 30 minutes. Every attempt is logged with its status code and duration. An address that keeps failing is switched off, and you can turn it back on once it is fixed.

Safety. The address must use https and point to a public server. Addresses on private networks are refused when you save and again at delivery, and redirects are not followed.

Webhooks with n8n, Zapier and Make

The sona.to apps for n8n, Zapier and Make have ready triggers for the same four events, so you do not need to paste an address yourself: add the trigger and the app sets up the webhook. See social media automation with n8n, Zapier and Make.

Full details, with a signature check example, are in the API documentation.

Frequently asked questions

Is a webhook the same as an API?

No. An API answers when you ask. A webhook sends you a message when something happens.

Are sona.to webhooks free?

Webhooks are included on every plan, along with the API.

What happens if my server is down?

sona.to tries again three times over about half an hour. If deliveries keep failing, the webhook is switched off until you turn it back on.