Messaging & Communications Integration Guide

Test WhatsApp Cloud API Webhooks Online

Test Meta WhatsApp Cloud API webhooks, verify hub.challenge tokens, and inspect incoming messages without server setup.

Direct Answer / Quick Summary

To test WhatsApp Cloud API webhooks, configure your SafeWebhook URL in Meta for Developers > WhatsApp > Configuration. Complete the verification handshake (hub.challenge) and inspect incoming text, media, and location payloads live.

Key Capabilities & Testing Highlights

•Handles Meta hub.mode, hub.challenge, and hub.verify_token verification.
•Inspect nested WhatsApp message structures, phone numbers, and button callbacks.
•Validate X-Hub-Signature-256 using your Meta App Secret.
•Replay incoming WhatsApp chats to your local bot backend.

Signature Header

X-Hub-Signature-256

Cryptographic Scheme

HMAC-SHA256 (Meta Scheme)

Payload Retention

100% Client-Side

Step-by-Step WhatsApp Cloud API Webhook Setup

Follow these 4 simple steps to capture real-time WhatsApp Cloud API events in your browser:

Open Meta Developer Portal > WhatsApp > Configuration > Edit Webhook.

Paste your SafeWebhook URL into Callback URL and supply a Verify Token.

Configure SafeWebhook Response Config to return the verify_token in plain text for the handshake.

Subscribe to `messages` and send a test WhatsApp message from your phone.

Sample WhatsApp Cloud API Webhook Payload

application/json

{
  "object": "whatsapp_business_account",
  "entry": [
    {
      "id": "1098492049281",
      "changes": [
        {
          "value": {
            "messaging_product": "whatsapp",
            "metadata": {
              "display_phone_number": "+1555029384",
              "phone_number_id": "102938491029"
            },
            "contacts": [
              {
                "profile": {
                  "name": "Alex Developer"
                },
                "wa_id": "1555123456"
              }
            ],
            "messages": [
              {
                "from": "1555123456",
                "id": "wamid.HBgLM...",
                "text": {
                  "body": "Hello SafeWebhook"
                },
                "type": "text"
              }
            ]
          },
          "field": "messages"
        }
      ]
    }
  ]
}

WhatsApp Cloud API Signature Verification Recipes

Copy-paste production-ready HMAC verification code for your backend:

Node.js / Express Recipecrypto.timingSafeEqual

// WhatsApp Cloud API Webhook Verification & Handler
app.get('/webhook', (req, res) => {
  const mode = req.query['hub.mode'];
  const token = req.query['hub.verify_token'];
  const challenge = req.query['hub.challenge'];
  if (mode === 'subscribe' && token === process.env.VERIFY_TOKEN) {
    res.status(200).send(challenge);
  } else {
    res.sendStatus(403);
  }
});

Python / Flask / FastAPI Recipehmac.compare_digest

@app.route('/webhook', methods=['GET'])
def verify_whatsapp():
    mode = request.args.get('hub.mode')
    token = request.args.get('hub.verify_token')
    challenge = request.args.get('hub.challenge')
    if mode == 'subscribe' and token == 'MY_VERIFY_TOKEN':
        return challenge, 200
    return 'Forbidden', 403

Frequently Asked Questions: WhatsApp Cloud API Webhooks

Why does Meta WhatsApp require a GET handshake before sending POST webhooks?

Meta performs an initial GET request with hub.challenge and hub.verify_token to verify ownership of the callback URL before dispatching live user events.

Ready to test WhatsApp Cloud API webhooks in real-time?

Get your free, private edge endpoint instantly. Zero signup, zero credit card, 100% free forever.

Launch Webhook Workbench →

Related Messaging & Communications Webhook Guides

Telegram Bot API Webhooks

X-Telegram-Bot-Api-Secret-Token