API referenceInbound

GET /webhooks/meta/{product}

Meta verification handshake: echoes hub.challenge (text/plain) when hub.mode=subscribe and hub.verify_token = META_WEBHOOK_VERIFY_TOKEN

GET
/webhooks/meta/{product}

Path Parameters

product*string
Value in"instagram""facebook""threads""whatsapp"

Query Parameters

hub.mode?string

subscribe

hub.verify_token?string

Verify token

hub.challenge?string

Challenge to echo

Response Body

hub.challenge

response?stringtext/plain
Example Request
curl -X GET 'https://example.com/api/webhooks/meta/instagram'
Example Response
"string"

POST /webhooks/telegram POST

Telegram Bot API updates (message, channel_post, my_chat_member), registered with npm run telegram:set-webhook. X-Telegram-Bot-Api-Secret-Token must equal TELEGRAM_WEBHOOK_SECRET (compared in constant time). /connect <code> in a channel or group (or a forwarded channel post) links the chat; the bot being removed or losing the right to post flags the account needs_reconnect (account.disconnected). Always 200 for authentic updates, including ignored ones

POST /webhooks/meta/{product} POST

Meta event delivery, signed with X-Hub-Signature-256 (sha256=<hex HMAC of the raw body>) by the product's app secret (instagram: INSTAGRAM_CLIENT_SECRET, facebook: FACEBOOK_APP_SECRET, threads: THREADS_APP_SECRET, whatsapp: WHATSAPP_APP_SECRET, then FACEBOOK_APP_SECRET). Stored as inbound events (deduplicated) and emitted as comment.received / mention.received; messaging events are stored as conversations and messages and emitted as message.*