Webhooks and APIs for Non-Developers

Plants.work · 2026-10-26 · upskilling

Understand APIs and webhooks in plain language, with key terms, a LINE OA to Google Sheets example, and how to set them up securely.

You may have sat in a meeting while the tech team said "we'll fire a webhook in" or "we need an API key first", and nodded along without being sure. That is completely normal. But if you work in marketing, operations or run a business and want to build automation yourself, these two words are the first door to walk through, because every workflow in n8n, Make or Zapier runs on these two ideas.

What are APIs and webhooks?

API: you go and ask

An API (Application Programming Interface) is a channel one system opens so other systems can request data or trigger actions. Think of calling a shop to ask "has my order arrived?" You start the conversation and can ask any time, but ask too often and it is wasteful; ask too rarely and you find out late.

Webhook: they tell you

A webhook is when the source system sends you a message itself the moment something happens, like the shop calling to say "your order is here". You just leave an address (a URL) and wait.

Six terms you need to know

Endpoint: the destination URL that receives requests.
Method: the type of request. The most common are GET (read data) and POST (send data in).
JSON: the data format most systems use with each other, made of name and value pairs, such as customer name and "Somchai".
Header: extra information attached to a request, such as an authentication key.
API key or token: a code proving you are allowed in. Guard it like a password.
Status code: a number telling you the result. The 2xx range means success; the 4xx range usually means a problem with the request, such as missing permission.

A real example: LINE OA messages into Google Sheets

An online flower shop wants every message customers send to its LINE OA recorded in Google Sheets, to see what customers ask most. The steps:

Create an n8n workflow that starts with a Webhook node, which gives you a URL.
Paste that URL as the Webhook URL in your LINE Messaging API settings.
LINE's documentation says that whenever someone adds the account as a friend or sends a message, the platform sends an HTTP POST with the event data to that URL.
n8n receives the JSON, picks out only the time, message type and text, and adds a row to Google Sheets through a connection that uses Google's API.

In this one example you use both: LINE uses a webhook to tell you, and n8n uses an API to write into Google Sheets.

What to know when setting up a webhook in n8n

Test URL and production URL are different

The n8n docs explain that the test URL is for building, with data shown in the workflow editor, while the production URL works once the workflow is published, with runs visible in the Executions tab. A common mistake is leaving the test URL in a live system and wondering why data stopped arriving.

Lock the door

The n8n Webhook node can require callers to authenticate with Basic auth, Header auth or JWT, and can restrict which IPs may call it. LINE recommends verifying the request signature before processing, to confirm it really came from LINE.

Respond quickly

Many source systems expect a 2xx status in response and may treat anything else as a failure. LINE's docs say redelivery happens when the server does not return 2xx, must be enabled in the console, and is not guaranteed every time.

With an API, you call to ask. With a webhook, they call to tell you.

Watch out for

Never paste API keys into chats, emails or company-wide shared documents. Use your tool's credential store instead.
A webhook URL without authentication lets anyone who knows it send fake data.
Data flowing through webhooks often includes personal data. Keep only what you need, in line with Thailand's PDPA.
Most APIs have rate limits. Calling too often can get you temporarily blocked.

How to get started

Create a workflow with one Webhook node and send it data from a test form.
Look at the incoming JSON and practise picking only the fields you need.
Connect Google Sheets as the destination.
Turn on authentication, then switch to the production URL.
Read the API docs for the system you use most, and check whether it offers webhooks.

Curious how APIs differ from newer standards like MCP? Try the course What is MCP and how it differs from an API, and practise connecting real apps in the n8n Integrations course on Plants.work Learn.