Set up Instagram Webhooks

• Advanced Access is required for comments and live_comments notifications.
• The account that owns the media must be public. Private accounts do not receive comment or mention notifications.
• Comment notifications for live media stop when the broadcast ends.
• You cannot select fields for each app user account. An account receives every field selected for the app.
• Notifications do not include album IDs. Use the comment ID to query the album ID.
• Notifications do not return ad IDs for media used in dynamic ads.
• story_insights notifications contain only the first 24 hours of metrics. This limit also applies when a story is saved as a highlight.

GET https://www.your-clever-domain-name.com/webhooks?
  hub.mode=subscribe&
  hub.challenge=1158201444&
  hub.verify_token=meatyhamhock

POST / HTTPS/1.1
Host: your-clever-domain-name.com/webhooks
Content-Type: application/json
X-Hub-Signature-256: sha256={super-long-SHA256-signature}
Content-Length: 311

{
  "entry": [
    {
      "time": 1520383571,
      "changes": [
        {
          "field": "photos",
          "value":
            {
              "verb": "update",
              "object_id": "10211885744794461"
            }
        }
      ],
      "id": "10210299214172187",
      "uid": "10210299214172187"
    }
  ],
  "object": "user"
}

curl -i -X POST \
  "https://graph.instagram.com/v26.0/<INSTAGRAM_ACCOUNT_ID>/subscribed_apps
  ?subscribed_fields=<WEBHOOK_FIELDS>
  &access_token=<INSTAGRAM_USER_ACCESS_TOKEN>"

{
  "success": true
}

curl -i -X POST \
  "https://graph.facebook.com/v26.0/<FACEBOOK_PAGE_ID>/subscribed_apps
  ?subscribed_fields=<WEBHOOK_FIELDS>
  &access_token=<FACEBOOK_PAGE_ACCESS_TOKEN>"

{
  "success": true
}

1. Install the Meta outbound API CA certificate
2. Verify the client certificate against the CA certificate
3. Verify the common name (client.webhooks.fbclientcerts.com) of the client certificate

1. Download the Meta outbound API CA certificate (meta-outbound-api-ca-2025-12.pem) to your server, for example to /etc/ssl/certs/meta-outbound-api-ca-2025-12.pem
2. Turn on mTLS by Nginx directives

   ssl_verify_client          on;
   ssl_client_certificate     /etc/ssl/certs/meta-outbound-api-ca-2025-12.pem;
   ssl_verify_depth           3;
   
3. Verify the CN from Nginx embedded variable $ssl_client_s_dn equals "client.webhooks.fbclientcerts.com" (

   if ($ssl_client_s_dn ~ "CN=client.webhooks.fbclientcerts.com") {
        return 200 "$ssl_client_s_dn";
   }
   

1. Download the Meta outbound API CA certificate (meta-outbound-api-ca-2025-12.pem) to an S3 bucket.
2. Configure the HTTPS listener on the ALB to enable mTLS with the trust store containing the Meta CA certificate in the S3 bucket.
3. In your application code, extract the CN from the HTTP header “X-Amzn-Mtls-Clientcert-Subject”⁠, and verify it equals "client.webhooks.fbclientcerts.com".

1. Use Test for a selected field in the App Dashboard. Confirm that your endpoint receives the sample notification.
2. Trigger an event for the connected account. For a messaging app, send the account a test message.
3. Confirm that your endpoint checks the signature and returns a successful HTTPS response.
4. Confirm that duplicate notifications do not repeat an action.
5. Compare the payload with the Webhook notification examples.

• The callback URL passed its check and is reachable over HTTPS.
• Your app selected the expected field.
• Notifications are enabled for the app user account.
• The token matches the login setup used by the request.
• The app has the right access level for the field.
• The account meets the field rules.
• Your server returns a success response before it starts slow work.

1. Create a Heroku account and deploy the sample app.
2. In the Meta App Dashboard, open App settings > Basic and copy the app secret.
3. Choose a verify-token string.
4. In the Heroku app settings, create APP_SECRET and TOKEN configuration variables. Set APP_SECRET to the app secret and TOKEN to the verify-token string.
5. Open the Heroku app URL. An empty array ([]) appears before notifications are received.
6. Use the Heroku app URL with /facebook appended as the callback URL.
7. Use the TOKEN value as the verify token when configuring Webhooks in the App Dashboard.

1. In the App Dashboard, open the Webhooks product and select Test for a webhook field.
2. Review the sample payload, then select Send to My Server.
3. Confirm that the notification appears at the Heroku app URL. You can also run curl https://<YOUR_SUBDOMAIN>.herokuapp.com.

• Learn how to send and receive messages from Instagram professional accounts.
• Review Webhooks from Meta.