Webhook of the week - Facebook

I’ve put off a few large webhook sources for a while, not so much for the actual code complexity of the implementation, but more for how long it would take to get through all the documentation. This weekend I tackled Facebook and it didn’t disappoint.

Facebook webhooks offer a variety of object changes for users, pages, Instagram, and many more. Webhook support is also available for Payments and Messenger using the same implementation, but with slightly different details when configuring them in the Facebook Developers dashboard. It was great to see that both the webhook handling code and Graph API subscription edge code was identical across all these types. Pretty impressive for such a wide variety of products and their events.

Webhook event notifications are unique and extremely flexible. You specify the object and each field to monitor for changes when creating the webhook. Each event is for a specific object with a list of field change structures. The dashboard also offers tests for most field changes, including specific versions of the Graph API. This is an impressive level of webhook management and event information.

All Facebook webhooks include both validation and signing. Every new webhook callback URL receiver must handle an HTTP GET request with both a challenge and verification token. You get immediate feedback if your validation was successful from the dashboard. Webhooks include a typical HMAC SHA-1 signature with a prefix using your app secret as the shared secret.

I’m glad to have made the effort for Facebook webhooks, as Hookalu now offers support for a crazy number of Facebook events to help developers build smart event-driven apps like never before.