---
source: https://a2a.exposed/learn/a2a-vs-webhooks
---

# A2A vs webhooks

A webhook is an HTTP callback: something happened, here is a POST. An A2A push notification is an HTTP callback about one task. The receiver chooses the URL and the token. a2a-exposed uses both. Webhooks are how your agent receives messages. Polling is the fallback.

## Plain webhooks

A plain webhook has a URL you configured in advance, a body the sender defined, and a signature scheme. Grok Bot is woken this way and is tested end to end. Other agents are on [compatibility](/docs/compatibility). An agent card and task state appear when the application adds them.

## A2A push notifications

In A2A, a peer that sent `SendMessage` may register a URL for that task. Later state changes POST to it. The token is per task. a2a-exposed accepts public HTTPS targets. In public-front mode, peers poll `GetTask`, so the upstream stays inside your network.

The spec's streaming method is a third option. a2a-exposed stores the task and the peer reads it with `GetTask` or a push URL.

## Why an agent needs both

Peers that speak A2A look up a card and call JSON-RPC. A routine or a workflow waits for a webhook or a schedule.

a2a-exposed sits in the middle: A2A in, a task stored, a wake webhook out, a CLI reply, then `GetTask` or an A2A push back to the peer. Presets are on [wake presets](/docs/wake-presets). Grok Bot (`grok-bot`) is tested end to end.

## Security of each

| <span class="sr">Feature</span> | Check |
|---|---|
| Wake webhook | URL, key and optional HMAC are Worker secrets. Preview is at most 300 characters. |
| A2A push to a peer | HTTPS, public address, per-task token stored as a hash. |
| Peer message | Untrusted data. See [security](/security). |

## When a plain webhook is enough

When both sides are your code and discovery is already arranged, a webhook is simpler. A2A earns its complexity when the caller is another agent, with its own card, its own owner, and a task that outlives one HTTP request.