Webhook integration

What is a webhook and how is it different from an API?

Connecting a Meta webhook

1. 1

   Expose an endpoint

   You need an HTTPS address that supports both GET and POST.

2. 2

   Answer the verification request

   If hub.verify_token in the GET request matches your value, return hub.challenge as plain text.

3. 3

   Verify the signature

   Compare the X-Hub-Signature-256 value with an HMAC-SHA256 of the raw body computed with your app secret.

4. 4

   Split the events

   One delivery may contain several objects and several changes. Turn each into a separate event.

5. 5

   Deduplicate

   Meta sends no event ID and may redeliver. Build the key from the payload (leadgen_id, message mid, comment ID) — dedupe_key(event) in the SDK — and store it in a unique column.

6. 6

   Respond quickly

   Return 200 immediately and push heavy work onto a queue — otherwise Meta marks the delivery as failed.

Verifying the signature correctly

The code below shows the standard check from Meta's documentation without the SDK. In the Socialift SDK the same check is verify_request(app_secret, body, headers), which you call from your own endpoint.

import hmac, hashlib

def verify(raw_body: bytes, header: str, app_secret: str) -> bool:
    # the header looks like: "sha256=abcdef..."
    if not header or not header.startswith("sha256="):
        return False
    expected = hmac.new(
        app_secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    # constant-time comparison — protects against timing attacks
    return hmac.compare_digest(expected, header.split("=", 1)[1])

What the Socialift SDK gives you

Which events arrive

yesnoScroll the table sideways

Security checklist for a webhook endpoint

• ▸Never process a request whose signature you have not verified.
• ▸Keep verify_token and app_secret out of source control — use environment variables.
• ▸Expose the endpoint over HTTPS only.
• ▸Cap the request body size and harden JSON parsing.
• ▸Queue events: the delivery response must be 200, processing happens afterwards.
• ▸Store the dedupe key and timestamp (entry.time) — for dedupe and for audit.