This document explains how to set up a Webhook that will notify you whenever your app's Users publish any changes to their User photos. Once you understand how to set up this Webhook you will know how to set up all Webhooks.
Setting up any Webhook requires you to:
These steps are explained in detail below.
Your endpoint must be able to process two types of HTTPS requests: Verification Requests and Event Notifications. Since both requests use HTTPs, your server must have a valid TLS or SSL certificate correctly configured and installed. Self-signed certificates are not supported.
The sections below explain what will be in each type of request and how to respond to them. Alternatively, you can use our sample app which is already configured to process these requests.
Anytime you configure the Webhooks product in your App Dashboard, we'll send a GET
request to your endpoint URL. Verification requests include the following query string parameters, appended to the end of your endpoint URL. They will look something like this:
GET https://www.your-clever-domain-name.com/webhooks? hub.mode=subscribe& hub.challenge=1158201444& hub.verify_token=meatyhamhock
Parameter | Sample Value | Description |
---|---|---|
|
| This value will always be set to |
|
| An |
|
| A string that that we grab from the Verify Token field in your app's App Dashboard. You will set this string when you complete the Webhooks configuration settings steps. |
Note: PHP converts periods (.) to underscores (_) in parameter names.
Whenever your endpoint receives a verification request, it must:
hub.verify_token
value matches the string you set in the Verify Token field when you configure the Webhooks product in your App Dashboard (you haven't set up this token string yet).hub.challenge
value.If you are in your App Dashboard and configuring your Webhooks product (and thus, triggering a Verification Request), the dashboard will indicate if your endpoint validated the request correctly. If you are using the Graph API's /app/subscriptions endpoint to configure the Webhooks product, the API will indicate success or failure with a response.
When you configure your Webhooks product, you will subscribe to specific fields
on an object
type (e.g., the photos
field on the user
object). Whenever there's a change to one of these fields, we will send your endpoint a POST
request with a JSON payload describing the change.
For example, if you subscribed to the user
object's photos
field and one of your app's Users posted a Photo, we would send you a POST
request that would look something like this:
POST / HTTPS/1.1 Host: your-clever-domain-name.com/webhooks Content-Type: application/json X-Hub-Signature-256: sha256={super-long-SHA256-signature} Content-Length: 311 { "entry": [ { "time": 1520383571, "changes": [ { "field": "photos", "value": { "verb": "update", "object_id": "10211885744794461" } } ], "id": "10210299214172187", "uid": "10210299214172187" } ], "object": "user" }
Payloads will contain an object describing the change. When you configure the webhooks product, you can indicate if payloads should only contain the names of changed fields, or if payloads should include the new values as well.
We format all payloads with JSON, so you can parse the payload using common JSON parsing methods or packages.
We do not store any Webhook event notification data that we send you, so be sure to capture and store any payload content that you want to keep.
Most payloads will contain the following common properties, but the contents and structure of each payload varies depending on the object fields you are subscribed to. Refer to each object's reference document to see which fields will be included.
Property | Description | Type |
---|---|---|
| The object's type (e.g., |
|
| An array containing an object describing the changes. Multiple changes from different objects that are of the same type may be batched together. |
|
| The object's ID |
|
| An array of strings indicating the names of the fields that have been changed. Only included if you disable the Include Values setting when configuring the Webhooks product in your app's App Dashboard. |
|
| An array containing an object describing the changed fields and their new values. Only included if you enable the Include Values setting when configuring the Webhooks product in your app's App Dashboard. |
|
| A UNIX timestamp indicating when the Event Notification was sent (not when the change that triggered the notification occurred). |
|
We sign all Event Notification payloads with a SHA256 signature and include the signature in the request's X-Hub-Signature-256
header, preceded with sha256=
. You don't have to validate the payload, but you should.
To validate the payload:
X-Hub-Signature-256
header (everything after sha256=
). If the signatures match, the payload is genuine.Your endpoint should respond to all Event Notifications with 200 OK HTTPS
.
Event Notifications are aggregated and sent in a batch with a maximum of 1000 updates. However batching cannot be guaranteed so be sure to adjust your servers to handle each Webhook individually.
If any update sent to your server fails, we will retry immediately, then try a few more times with decreasing frequency over the next 36 hours. Your server should handle deduplication in these cases. Unacknowledged responses will be dropped after 36 hours.
Note: The frequency with which Messenger event notifications are sent is different. Please refer to the Messenger Platform Webhooks documentation for more information.
Once your endpoint or sample app is ready, use your app's App Dashboard to add and configure the Webhooks product. You can also do this programmatically by using the /{app-id}/subscriptions
endpoint for all Webhooks except Instagram.
In this example we'll use the dashboard to configure a Webhook that subscribes to any changes to the photos of any of your app's Users.
Enter your endpoint's URL in the Callback URL field and enter a string in the Verify Token field. We will include this string in all Verification Requests. If you are using one of our sample apps, this should be the same string you used for your app's TOKEN
config variable.
Once you click Verify and Save, we'll send your endpoint a Verification Request which you must validate. If your endpoint successfully validates the request, you should see this:
The last step is to subscribe to individual fields. Subscribe to the photos
field and send a test Event Notification.
If your endpoint is set up correctly, it should validate the payload and execute whatever code you have set it up to do upon successful validation. If you are using our sample app, load the app's URL in your web browser. It should display the payload's contents:
Now that you know how to set up Webhooks, you may want to refer our additional documents that describe the extra steps involved when setting up Webhooks for specific products: