What are the webhook address and verify token for?

The webhook address (Callback URL) is where Meta sends every new message from your connected pages. The verify token is a secret word Meta uses once to check that the address is really yours. Your Meta app secret then checks that each message really came from Meta.

Where to find it

Admin › CRM › Inbox › Inbox settings, in the box For the Meta app (webhook).

You need the Inbox settings tick. Admin gets it with the role, and the store owner always has it. The verify token and the app secret are shown masked to everyone; only the owner can show the verify token (press Show) and change the app secret.

How it works

Callback URL. It is your own store's address followed by /crm/meta/webhook, for example https://rangdhanufashion.com/crm/meta/webhook. Copy it from the screen exactly as shown and paste it into the Webhooks part of your Meta app.
Verify token. A random word made for your store the first time Inbox settings is opened. It stays the same after that. Paste it next to the Callback URL in your Meta app. When Meta checks the address, your store answers only if the word matches.
Meta app secret. Each store uses its own Meta app. Copy the secret from your app's App settings › Basic and paste it into Meta app secret in the Rules box, then press Save rules. Every message Meta sends is signed with this secret. Your store takes a message only when the signature matches, so nobody else can push fake messages into your inbox.

Once all three are in place, messages from your page land in Inbox and are shared out to your sellers.

Good to know

Until the app secret is saved, the field shows not set — messages are refused until it is. Messages are not taken at all in that time.
To keep the saved secret, leave the field empty when you save the rules.
The same box lists the fields to subscribe to in your Meta app: for a page messages, messaging_postbacks, messaging_referrals, message_echoes, message_reads, message_deliveries and feed (for comments). For Instagram, messages and comments. For WhatsApp, messages.
Last calls from Meta shows the most recent calls Meta made to your store, each with ok or the reason it failed.

Common problems

Meta says the Callback URL could not be verified. Check that you copied both the address and the verify token from this screen with no extra spaces.
Last calls from Meta shows "Signature did not match". The app secret saved here is not the secret of the app that sends the messages. Copy it again from App settings › Basic and save the rules.
Last calls shows "App secret is not set". Paste the app secret and press Save rules.
Nothing appears under Last calls. Meta is not calling your store yet. Check the Callback URL and the subscribed fields in your Meta app.

Still need help? Ask in our Facebook group — the team and other shop owners answer there.

Ask the community →