Meta inbound webhook (public, shared by all Meta products)

POST 
/api/meta/webhook

PUBLIC server-to-server endpoint Meta calls for WhatsApp / Messenger / Instagram events — ONE app-level URL for all three. NO session / Sanctum / tenant / CSRF. Routed by the top-level object + a platform id in the payload (phone_number_id / page id / ig id); trusted ONLY after the X-Hub-Signature-256 HMAC verifies against the PLATFORM app secret (one platform Meta App). The tenant is resolved from the routing directory (never the request). Always 200 { ok: true } for a verified delivery (so Meta does not retry-storm); a bad/missing signature gets 403 and an unknown/inactive channel gets 404. Idempotent on the provider message id.

Request

Responses

200

Acknowledged (verified delivery; the event may have been ignored).

403

The X-Hub-Signature-256 is missing or does not verify.

404

Unknown or inactive channel for the payload's platform id.