Connections
Meta webhook verify token explained
Platform owner only: what the Meta webhook verify token is, where it starts and where it goes.
Before you start
- You're the platform owner.
The steps at a glance
Step 1 of 4
A verify token is a password you invent — long and random, e.g. from your password manager. It is not given to you by Meta.
Run “npx wrangler secret put META_WEBHOOK_VERIFY_TOKEN” and paste it. (WhatsApp uses WHATSAPP_VERIFY_TOKEN.)
In Settings → Platform (owner only), tap Set up app webhooks. We send the same token to Meta for you.
In Meta's Webhooks page, paste the callback address and the same token in Verify token, then Verify and save.
What the code looks like
Find it: You make it up (password manager)Paste it: Cloudflare secret META_WEBHOOK_VERIFY_TOKEN and Meta → Webhooks → Verify token
Not this: EAAG… (an access token) or the App secret — those are given by Meta. The verify token is your own made-up word.
✅ How do I know it worked?
- Meta shows a green tick next to the webhook, and Check with Meta is happy.
⚠️ Common mistakes
ProblemMeta says “The URL couldn't be validated”.FixThe token in Meta and in Cloudflare must match exactly — no spaces. Deploy after changing the secret.
ProblemYou used the App secret as the token.FixMake up a new random token. Never paste the App secret anywhere else.