Webhook System Development for Site Integrations

Webhook System for a Site: Receiving, Sending, and Monitoring Events

Consider: when a payment gateway sends a transaction notification, the connection timeout rarely exceeds 10 seconds. If the server fails to return HTTP 200 OK, the provider retries the request, and data may be duplicated or lost. Over five years, we have implemented over 20 webhook integrations with various services: Stripe, GitHub, CRM systems. Every detail — from HMAC verification to a dead letter queue — has been tested across dozens of projects. We know how to avoid synchronous processing, duplicate ignorance, and weak verification.

A naive implementation handles events synchronously, ignores duplicate identifiers, and skips signature verification. The result: double charges, lost orders, silent integration failures. Our approach eliminates these risks at the design stage. Get a consultation — we will assess the complexity of your integrations and propose an architecture that won't fail. Contact us to discuss details.

Why Webhooks over Polling?

Webhooks are the obvious choice for real-time notifications. They require proper processing: verification, deduplication, and retry. The time and resource savings from using webhooks justify the implementation cost.

How We Implement Secure Webhook Reception

We build the architecture on Laravel with Redis queues. The key point is signature verification before any business logic. Each provider uses its own algorithm:

Stripe / HMAC-SHA256:

$secret = config('services.stripe.webhook_secret');
$sigHeader = $request->header('Stripe-Signature');
$payload = $request->getContent();
list($t, $v1) = parseStripeSignature($sigHeader);
$signed = hash_hmac('sha256', "{$t}.{$payload}", $secret);
if (!hash_equals($signed, $v1)) {
    throw new InvalidSignatureException();
}

Always use hash_equals — protection against timing attacks. After verification, the job is dispatched to the queue to avoid blocking the response (provider timeout is 3–10 s).

Deduplication: We set job uniqueness for one hour using uniqueFor. In the database, we check external_id and skip duplicates. This eliminates double payment charges or duplicate orders.

What Makes the System Fault-Tolerant?

Outgoing event sending is managed by subscriptions: each request is signed with HMAC, and exponential backoff is applied on errors. After 10 failures, the subscription is automatically deactivated — you receive a Telegram notification. The dead letter queue collects unprocessed jobs, and engineers are alerted.

Exponential backoff with jitter reduces load on the external service and increases delivery success.

What's Included in Turnkey Webhook System Development

• Receiving incoming webhooks: route registration, signature verification, logging, queue dispatching.
• Sending outgoing events: subscription management, signing, retry logic, deactivation.
• Monitoring dashboard: view incoming/outgoing requests, statuses, payload, errors. Optional integration with Laravel Telescope.
• Dead letter queue: unprocessed jobs go to a separate queue with alerts.
• Documentation and training: API description, instructions for your team.
• Warranty: support for one month after launch.

Process and Timelines

1. Analysis — discuss providers, events, security requirements.
2. Design — choose queue, signature scheme, table structure.
3. Implementation — write code, cover main scenarios with tests.
4. Testing — run integration tests, simulate events.
5. Deployment and monitoring — deploy on your server, connect alerts.

A basic system (one provider, verification, queue) — from 1 working day. A full platform with subscriptions, dashboard, and retry — 3–5 days. Cost depends on the number of integrations and complexity — contact us, we will prepare an offer.

Common Mistakes in Webhook Implementation

• Synchronous processing — response to client takes more than 10 s, provider considers event undelivered.
• Ignoring duplicates — repeated requests lead to double operations.
• Weak verification — anyone can call your endpoint and forge data.
• Lack of monitoring — errors go unnoticed, subscriptions "hang."

Stripe uses HMAC-SHA256 for signatures — the same approach we apply. Laravel queues provide built-in queues with uniqueness support. These technologies are proven by thousands of projects.

We account for risks at the design stage — this guarantees stable integration operation. Order webhook system development: discuss your project details and we will prepare a proposal.

Website CRM Integration: Bitrix24, amoCRM, Salesforce, HubSpot

A sales manager manually copies leads from email into the CRM. Half of them never make it. Follow‑up calls are missed. This isn’t a people problem — it’s an architectural gap between the website and the company’s core system. We close that gap with a direct site‑to‑CRM connection: leads land in the pipeline within 30 seconds after form submission, duplication is blocked, and status changes flow both ways automatically. Request a free integration audit to identify the bottlenecks in your current flow.

Integration isn’t just a POST to an API endpoint. It’s a battle against timeouts, duplicate records, data loss, and desynchronised states. We handle three core problems at once: asynchronous delivery (so the user never waits for the CRM), deduplication by email (one address – one lead), and two‑way feedback (a status change in the CRM instantly appears on the site). Below is how we tackle each.

Bitrix24: REST API and Event Handlers

Bitrix24 dominates the Russian B2B space. Its REST API works via OAuth 2.0 or an incoming webhook (webhook is simpler but less secure for production). Main entities are lead, deal, contact, and company.

Creating a lead requires POST /rest/crm.lead.add with the correct field set. Attaching it to a funnel means passing SOURCE_ID. Adding a timeline comment uses crm.timeline.comment.add. Real‑time tracking is done through Event Handlers: register a hook with event.bind; Bitrix24 pushes a POST to your endpoint when any deal status changes.

The real complexity lies in custom fields. Every Bitrix24 installation has its own set, and their IDs must be fetched via crm.lead.fields. Mapping those fields between the site and the CRM can be done manually or automatically — we use an automatic detection mechanism that works even in non‑standard configurations (proven on 20+ projects). We guarantee correct matching, so no lead arrives without the right pipeline stage or source tag.

amoCRM: Clean REST with Predictable Endpoints

amoCRM (now Kommo for international markets) offers a cleaner API. OAuth 2.0 with refresh token, JSON API, and well‑structured endpoints. Pipelines are pipelines, deals are leads, contacts are contacts.

A common mistake: when creating a deal you must supply pipeline_id and status_id explicitly. Without them the deal lands in the default pipeline – often the wrong one. Tags for source classification go into _embedded.tags. Incoming webhooks are configured in the admin panel; they support add, update, delete, status, and note events. We always verify the webhook signature using the API key and make sure the endpoint responds with 200 OK in under 5 seconds – otherwise the CRM marks delivery as failed.

Salesforce and HubSpot: Enterprise‑Grade Integration

Salesforce is the enterprise standard. It offers REST API, SOQL for complex queries, and Apex for server‑side logic. Integration can be direct via Salesforce REST API or through middleware like Zapier or MuleSoft. For PHP projects we use phpforce/soap-client or the Force.com‑Toolkit. The main challenge is mapping hundreds of custom objects and fields; we solve it with Describe Global to collect metadata automatically – cutting setup time by three‑quarters compared to reading documentation manually (Salesforce Developer Guide).

HubSpot is popular among SaaS companies and international B2B. Its API v3 provides a REST interface with solid SDKs for PHP and Node.js (@hubspot/api-client). Contacts, Companies, Deals are standard objects. The Forms API lets you send data from any custom form directly to HubSpot without using the native widget. One pitfall: the access_token must include the right scopes; a misconfigured token returns 403 Forbidden with a vague message. We include error_logging that captures the error code – debugging takes minutes instead of hours.

Which CRM fits your business: Bitrix24, amoCRM, or HubSpot?

Why is asynchronous sending important?

Calling a CRM API synchronously from the form handler is a mistake. The API may respond in 2 seconds – or time out. The user sits waiting. The correct pattern: form submission → save to database → queue a job → return 200 to the user immediately. A background worker then pushes the lead to the CRM. If the CRM is down, the worker retries with exponential backoff. We use Redis + Bull on Node.js or Laravel Queue on PHP – this guarantees delivery even during temporary outages.

Deduplication – how we stop duplicate leads

The same contact may fill the form twice. Without deduplication the CRM ends up with two identical leads. Before creating a new lead we search by email: for Bitrix24 we call crm.duplicate.findByComm, for HubSpot we use contacts/search. If a match is found we attach a task or comment to the existing lead instead of creating a new one. In our projects this cuts duplicate entries by 95%.

Two‑way synchronization – what happens when a manager changes a deal status

If a manager updates a deal status in the CRM, the website needs to reflect that change – especially if the client has a personal account. We configure webhooks from the CRM to an endpoint on the site, then update the local database and notify the client. Critical details: verify the webhook signature and respond with 200 OK within 5 seconds, otherwise the CRM assumes delivery failed. We guarantee that the delay between a status change in the CRM and its appearance on the site never exceeds 3 seconds.

How do we conduct integration in 5 steps?

1. Audit of data flows – analyse current lead transfer, CRM field structure, and performance bottlenecks. Deliverable: “as‑is” and “to‑be” data flow diagrams.
2. Architecture design – choose the queue mechanism (Redis Bull or Laravel Queue), define the deduplication method, and prepare a field mapping specification.
3. Implementation on staging – write code on Laravel or Node.js, configure webhooks, and test with real data: lead creation, status updates, and error handling.
4. Load testing – simulate peak traffic (e.g. 500 requests per minute) and adjust retry policies and timeout settings.
5. Deployment and documentation – push to production, train the team on monitoring and retry cleanup, and deliver full endpoint documentation.

What is included in the work

• Audit report with current data flow diagrams and typical error patterns.
• Architecture design document specifying queue, deduplication, and mapping.
• Production‑ready integration code on Laravel or Node.js.
• Webhook configuration and signature verification.
• Team training on support tasks and retry cleanup.
• 30‑day warranty support for bug fixes and mapping adjustments.

Real‑world case: real‑estate agency with 400 leads per month

Timelines

The exact cost is calculated after an audit of your current processes and CRM data structure. Contact us for a project estimate – we will send a commercial proposal within one business day. With 5+ years of experience and more than 20 completed integrations, you get a solution that works from day one. Get an engineer consultation to see how your sales funnel can run without manual lead transfer.

Additional sources: Customer relationship management (Wikipedia) · REST API (Wikipedia)