What is a webhook?

Compare refreshing a parcel-tracking page with getting a text when the parcel arrives. Checking on a timer, called polling, spends requests on “nothing new” and is always a little late. A webhook turns it around: the service that knows about the event sends the news to you.

1. You register a URL, often called a callback or endpoint, with the service, and choose which events you want to hear about.
2. When one happens, the service sends an HTTP POST request to that URL with the details as JSON: what happened, to which object, and when.
3. Your server checks that the request is genuine, answers 200 OK to confirm it arrived, and then acts on it.
4. If a delivery fails, the service tries again for a limited time, then gives up.

Tip: A webhook only reports. To act on the news, such as replying to a comment, the receiving app still calls the service’s API with its own access token.

Every comment-to-DM and auto-reply tool built on Meta’s official API depends on webhooks, and Meta’s documentation sets the rules:

• A handshake first. When a developer saves the URL in Meta’s App Dashboard, Meta sends a GET request with hub.mode set to subscribe, a hub.verify_token the developer chose and a hub.challenge number. The server checks the token and sends the challenge back.
• Signed deliveries. Each notification carries an X-Hub-Signature-256 header, a SHA-256 signature of the payload made with the app’s App Secret, so the receiver can reject forgeries.
• Batches and retries. Meta can group up to 1,000 updates in one request, though batching isn’t guaranteed. A failed delivery is retried straight away, then a few more times, less and less often, over 36 hours.
• Duplicates. Meta asks developers to handle deduplication, so a careful tool records each event and ignores repeats.
• A proper certificate. The endpoint needs a valid TLS certificate; self-signed ones aren’t supported.

Instagram adds conditions of its own. The app must be set to Live, it needs Advanced Access to receive comment notifications, the app has to be subscribed to each connected account, and the account that owns the post must be public for comment and @mention notifications to be sent. Comments during a Live arrive only while the broadcast is on.

Notice what isn’t there: no field for new followers. That’s why no tool built on the official API can DM someone the instant they follow; the person has to comment or message first.

Webhooks are why an auto-reply can land moments after a comment, and they’re the first thing to check when replies stop. The usual causes:

• The account was disconnected or its access expired. Reconnecting the account in the tool usually fixes it.
• The account went private or became a personal account. Meta only sends comment notifications for public professional accounts.
• Another app answered first. If two automation tools are connected to one account, each receives the same comment, and since Meta allows one private reply per comment, only the first succeeds.

Tip: Building one yourself? Answer 200 OK at once and do the slow work afterwards, check the signature before trusting the body, and store each event’s ID so a retried delivery never sends the same DM twice.