Webhook Receiving Endpoint Explained
Callback URL (paste into the Meta dashboard)
https://app.aifengdcs.com/api/meta/webhook
Verify token
META_VERIFY_TOKEN: a self-defined random string that lives only in the server environment; enter the same value on both sides when configuring the callback in Meta.
Subscribed fields (new messages are pushed only after these are checked)
Page object (FB Page)
messages — FB Page DMs (Messenger messages from customers)
messaging_postbacks — Button postbacks in FB DMs (quick replies / menu taps)
feed — FB Page post comments and replies (for conversation merging)
Instagram object (IG professional account)
messages — Instagram DMs (received by the professional account)
comments — Instagram post comments (for conversation merging)
Receiving flow (skeleton already implemented in this module)
- Meta first sends a GET verification: if hub.verify_token matches META_VERIFY_TOKEN, the server echoes hub.challenge
- Meta then pushes message events via POST (JSON example below)
- The server verifies the X-Hub-Signature-256 signature with META_APP_SECRET
- Parse entry[].messaging[] and changes[] (comments), then write into uc_meta_messages_v109
- The unique message_mid constraint dedups idempotently; retries never duplicate messages
Payload example (DM event)
{
"object": "page",
"entry": [{
"id": "<PAGE_ID>",
"time": 1735689600000,
"messaging": [{
"sender": {"id": "<USER_PSID>"},
"recipient": {"id": "<PAGE_ID>"},
"timestamp": 1735689600000,
"message": {"mid": "m_abc123", "text": "Halo, tanya harga"}
}]
}]
}
⚠ Real Meta connection (tokens, webhook go-live, permission review) is Human-Gate PENDING and runs only after the boss approves each step.