API reference / Notifications

get/v2/webhooks/whatsapp

WhatsApp webhook verification handshake

Operation
verifyWhatsAppWebhook
Authentication
None — public

Called once by Meta when the callback URL is saved, not by partners. **Unauthenticated**, and the shared secret is a query parameter rather than a header — the only authentication available at the moment a URL is being registered.

Meta sends `hub.mode=subscribe`, a `hub.verify_token` it read from the app dashboard, and a `hub.challenge`. The contract is to check the token and return the challenge **as the response body**: Meta compares the body it receives, so a 200 carrying JSON fails the check with nothing to explain why. Without `META_WA_VERIFY_TOKEN` the route answers 503 rather than echoing, because an endpoint that answers anyway can be claimed by anyone with an app.

Request

Parameters

hub.modequerystring
hub.verify_tokenquerystring
hub.challengequerystring

Responses

200The `hub.challenge` value, as `text/plain`.

Free-form JSON object.

403`hub.mode` is not `subscribe`, or the verify token does not match.
errorobjectrequired
503`META_WA_VERIFY_TOKEN` is not set, so nothing can be verified.
errorobjectrequired

Example

curl
curl -X GET https://api.haavisa.com/v2/webhooks/whatsapp

More in Notifications

Something unclear? The eligibility guide explains the model behind the answers; the errors guide covers the envelope.