By Repli Team · June 5, 2026 · Technical
Quick Answer
Understand Instagram webhook verification, signatures, account subscriptions and troubleshooting. Separate developer setup from Repli’s managed connection.
A webhook delivers an event from Meta to an application. Receiving that event, matching a rule and successfully sending a reply are separate operations. This guide explains developer setup and troubleshooting without asking ordinary Repli users to create a Meta app.
If you are connecting an account to Repli
Authorize the professional account through Instagram Login and approve the requested access. Repli handles its endpoint and account subscription. You do not paste a callback URL, choose a verification token or share your password. Reconnect when Repli reports revoked or expired access; reconnecting does not recover events Meta never delivered.
For developers: identify the login method
Instagram API with Instagram Login and legacy Facebook Login use different token identities, permissions and API hosts. For Instagram Login, relevant permissions include instagram_business_basic, instagram_business_manage_messages and instagram_business_manage_comments. Use only permissions required for your features and verify their access level. Instagram Login does not require a Facebook Page; do not copy Page-token setup into it.
Instagram Login resources use graph.instagram.com and the saved Instagram identity. Legacy Page-token integrations use their Facebook host and identity rules. Keep API version selection explicit and aligned with current Meta documentation; do not assume every app has production access.
Verify the endpoint challenge
Provide an HTTPS endpoint. During verification, Meta sends hub.mode, hub.verify_token and hub.challenge. Compare the supplied verification token with your configured value and return the challenge only when verification succeeds. A verification token is not an account access token; neither belongs in public page examples or logs.
Validate incoming POST requests
Verify X-Hub-Signature-256 against the raw request body using HMAC-SHA256 and the app secret before trusting the event. Do not calculate the signature after reformatting JSON. Keep secrets server-side, acknowledge legitimate requests promptly, and make processing safe against repeated delivery. A valid signature authenticates the sender; it does not establish which workspace owns the account.
Configure app fields and account subscription
App-level webhook configuration and the authorized account’s subscription are separate. For Instagram Login, subscribe the Instagram account through its /{ig-user-id}/subscribed_apps resource with the authorized token and supported fields, such as comments and messages where available. Confirm the correct object, fields, permissions and access in Meta’s current documentation rather than assuming every event is enabled.
Trace one event end to end
- Generate a new supported event from a different account.
- Check whether the verified webhook received it.
- Resolve its Instagram recipient/account identity to the authorized owner.
- Check the enabled rule, post scope and keyword.
- Inspect the separate public/private API-send result.
- Record safe error details without tokens or customer message contents.
A received comment does not guarantee a DM. Messaging windows, deleted comments, revoked permissions and provider restrictions can still block delivery.
Agency onboarding is not arbitrary webhook hosting
The agency onboarding API documents Repli’s supported account-onboarding workflow; it is not a promise of a general outgoing event API. Use Repli documentation for its supported integration steps.
Official references and troubleshooting
Consult Meta’s Instagram webhooks, webhook verification guide and Instagram Login API overview. Review the messaging-window explainer when reception works but sending fails.
Frequently Asked Questions
Does OAuth approval prove webhook delivery?
No. Verify account subscription and a fresh received event.
Will reconnecting restore missed events?
Do not assume replay or recovery. Test new events after authorized reconnection.
Should Repli users build this endpoint?
No. This technical explanation is for developers; Repli manages its own endpoint.