Zoho CRM Webhooks vs the Notification API

Polling Zoho CRM every few minutes to ask "has anything changed?" wastes API credits and still leaves gaps between checks. Event-driven integration flips the direction: Zoho tells your system when something happens. Zoho CRM webhooks, sent from workflow rules, and the Notification API, which streams record events for whole modules, both make this possible. Each suits different jobs, and both need careful handling on the receiving side. This guide explains the two options, when to use which, how to build a receiver that is secure and reliable, and a worked example of subscribing to deal changes and processing the callbacks.

Two ways to get real-time events from Zoho CRM

Workflow webhooks

A workflow rule in Zoho CRM can include a webhook action that calls your URL when the rule's conditions are met, such as when a deal moves to a particular stage. You choose the URL, method and parameters, including merge fields from the record. Zoho's help article on webhooks explains the setup. Webhooks are configured by administrators in the CRM, without code.

Notification API

The Notification API lets an integration subscribe to create, update and delete events on modules, and from version 6 onwards it can limit notifications to changes in specific fields. Each subscription, called a channel, has a channel ID, an optional verification token and an expiry time. According to Zoho's documentation for enabling notifications, the expiry can be at most one week ahead, and if it is not specified or is set beyond a week, it defaults to one hour.

Zoho CRM webhooks vs the Notification API

FactorWorkflow webhooksNotification APISet up byCRM administrator in workflow rulesDeveloper, through the APITriggerSpecific rule conditionsModule-level create, update and delete events, optionally field-specificPayloadParameters you define, including merge fieldsEvent details with record IDs; optionally the changed field valuesExpiryNone; runs while the rule is activeChannels expire and must be renewedBest forBusiness events, such as "deal won" or "lead qualified"General-purpose sync of a module to another system

Many integrations use both: webhooks for a few meaningful business events, and the Notification API for keeping a database or data warehouse in step with the CRM.

Building a reliable receiver

Acknowledge quickly

The receiver should validate the request, store the event durably and respond straight away. Heavy processing happens afterwards in a worker. This keeps responses fast and avoids repeated deliveries caused by slow replies.

Verify the source

For notifications, check that the channel ID and token in the callback match what you registered. For workflow webhooks, include a secret parameter or header in the webhook configuration and check it on every call. Accept requests only over HTTPS.

Expect duplicates and gaps

Events can arrive more than once, out of order, or not at all during outages. Make processing idempotent, fetch the current state of the record from the API when order matters, and run a periodic delta sync to catch anything missed.

Renew channels automatically

Schedule renewal well before each channel's expiry, and alert if renewal fails. A channel that silently expires is one of the most common causes of out-of-date data.

Worked example: subscribing to deal changes and handling callbacks

The illustrative request below subscribes to Deal events, limited to changes in the Stage field, with a verification token and an expiry a few days ahead. The structure follows the sample in Zoho's documentation, which also includes module and field IDs alongside API names; IDs and URLs here are placeholders.

{
  "watch": [
    {
      "channel_id": "1000000068001",
      "events": ["Deals.all"],
      "notification_condition": [
        {
          "type": "field_selection",
          "module": {"api_name": "Deals"},
          "field_selection": {
            "group_operator": "or",
            "group": [{"field": {"api_name": "Stage"}}]
          }
        }
      ],
      "channel_expiry": "2026-10-12T09:00:00+05:30",
      "token": "deals-stage-verify-7c1e",
      "notify_url": "https://integrations.example.com/zoho/notifications"
    }
  ]
}

This body is sent with a POST request to the actions/watch endpoint for your API domain. The receiver below verifies the callback, stores it and replies at once.

from fastapi import FastAPI, Request, HTTPException

app = FastAPI()
EXPECTED = {"1000000068001": "deals-stage-verify-7c1e"}     # channel_id -> token

@app.post("/zoho/notifications")
async def notifications(request: Request):
    event = await request.json()
    channel = str(event.get("channel_id"))
    if EXPECTED.get(channel) != event.get("token"):
        raise HTTPException(status_code=403)
    for record_id in event.get("ids", []):
        key = f"{event.get('module')}:{record_id}:{event.get('operation')}:{event.get('server_time')}"
        queue.put_if_absent(key, {"module": event.get("module"),
                                  "operation": event.get("operation"),
                                  "record_id": record_id})
    return {"status": "accepted"}

A worker then fetches each changed deal through the API and applies it to the target system. The keys used here, such as ids, module, operation, server_time, channel_id and token, appear in the sample callback in Zoho's documentation; the queue helper stands in for your own durable store. If you enable return_affected_field_values, the callback also lists the changed fields and their values, which can save an API call for simple updates.

Security considerations

• Use HTTPS endpoints only, and keep them separate from public website routes
• Verify tokens or secrets on every request, and rotate them periodically
• Do not trust payload contents blindly; fetch authoritative data from the API where it matters
• Rate-limit the endpoint and log rejected requests
• Avoid putting long-lived credentials in webhook URLs

Monitoring event delivery

Track events received per module per hour, rejected requests, queue depth and processing errors. Compare events received with changes found by the periodic delta sync: if the delta keeps finding changes that never arrived as events, investigate channel renewal or delivery problems.

Designing workflow webhooks well

For workflow webhooks, keep the payload small: send the record ID, the event name and a few key fields, and let the receiver fetch anything else it needs. Name each webhook clearly, so administrators understand what it does months later, and document which rule triggers it. Avoid building long chains where one webhook triggers a change that fires another rule and another webhook, because such loops are hard to trace.

When polling is still reasonable

For low-volume data that changes rarely, a scheduled delta sync using Get Records with the If-Modified-Since header can be simpler than maintaining event subscriptions. Event-driven integration pays off when changes are frequent and need to reach other systems quickly.

Testing event-driven flows

Test in a sandbox with a separate channel and endpoint. Change records in the ways users will, including bulk edits and imports, and check that every expected event arrives and is processed once. Let a channel expire on purpose to confirm alerts fire, and replay a duplicate callback to confirm idempotency. These tests prevent the subtle gaps that otherwise surface weeks later.

Events reduce polling and help you stay within credits; our guide to Zoho CRM API limits covers the rest. If webhook flows currently run through a connector platform, see our comparison of Zapier and custom API integration.

Frequently Asked Questions

Does Zoho CRM support webhooks?

Yes. Workflow rules can include webhook actions that call your URL when conditions are met, and the Notification API provides module-level event subscriptions for integrations.

How long do Zoho CRM notification channels last?

According to Zoho's documentation, a channel's expiry can be set up to one week ahead; if it is not set or exceeds a week, it defaults to one hour. Renew channels automatically.

How do we verify that a notification came from Zoho?

Register a token when enabling the channel and check that each callback carries the expected channel ID and token. For workflow webhooks, include and check a secret value.

Can events be missed?

Yes, during outages or expired channels. Run a periodic delta sync with If-Modified-Since to catch anything that did not arrive as an event.

Build event-driven integrations with us

We build Zoho CRM webhook and notification integrations with secure receivers, renewal and monitoring. See our CRM and API integration services, or talk to us about real-time integration.

About the Author

Manav Sharma is the founder of Insyrge and a CRM solutions architect. He works across Zoho, Salesforce, HubSpot, Odoo and more, designing the CRM setups, integrations and automations that keep sales and operations teams working from the same data.