How are Facebook Webhook event POSTs verified?

Generate an HMAC SHA-256 signature from the raw request body with the Meta app secret and compare it with the value after `sha256=` in `X-Hub-Signature-256`.

Is the setup verify token used to sign events?

No. The verify token is checked during the GET challenge. Event POSTs are signed separately with the app secret.

Why can one Facebook Webhook notification arrive twice?

Meta retries failed updates immediately and then less often for up to 36 hours. Deduplicate with identifiers appropriate to the subscribed object and field.

Can robots.txt block Facebook Webhooks?

No. Meta calls an endpoint registered by the app. Remove the subscription or reject the route if delivery is no longer wanted.

Is Facebook Webhooks an AI crawler?

No. It sends subscribed Graph API changes. FacebookBot and Meta's other crawlers are separate clients with different purposes.

Facebook Webhooks Bot Guide

What is Facebook Webhooks?

Facebook Webhooks, documented by Meta as Webhooks from Meta, sends Graph API change notifications to an app's HTTPS endpoint. The app subscribes to fields on an object type, and Meta posts JSON when a permitted object changes. Notifications can contain more than one update, so the receiver must inspect each entry rather than assuming one event per request.

Endpoint setup starts with a GET verification request. Meta sends hub.mode, hub.verify_token, and hub.challenge as query parameters. The endpoint checks that the mode is subscribe and that the token matches the private value configured in the App Dashboard, then returns the challenge. That handshake confirms control of the callback URL.

Later event notifications arrive as POST requests. Meta signs the raw JSON body with the app secret and places the HMAC SHA-256 value in X-Hub-Signature-256 with a sha256= prefix. The endpoint should verify it before processing and return 200 OK. Failed updates can be retried over the next 36 hours, so duplicate-safe handling is required.

Facebook Webhooks is separate from FacebookBot and from link-preview fetchers. It only reports subscribed Meta platform events to an app endpoint. It has no direct effect on AI search visibility or model training, and robots.txt does not apply to either the setup challenge or event POST.

Not relevant for AI search

Is Facebook Webhooks relevant for AI search?

No. Facebook Webhooks is not part of AI search or training, so allowing or blocking it does not change your AI visibility.

Facebook Webhooks is not a crawler. It delivers webhook notifications to endpoints you registered, so it never fetches public content for an AI product. Robots.txt does not apply, and allowing or blocking it has no effect on AI search or training.

How to handle Facebook Webhooks

Keep the configured callback on HTTPS with a valid certificate. Handle GET and POST separately: compare the GET verify token with the value stored for the app before returning hub.challenge, and calculate the POST HMAC from the untouched body with the app secret before accepting an event.

Store or queue a verified notification, deduplicate its updates, and respond with 200 OK without waiting on slow downstream work. Reject an invalid signature and keep the verify token and app secret out of logs and source control. A Facebook-looking user agent is not part of either authentication check.

When the app no longer needs the events, remove its object and field subscriptions in Meta's configuration before closing the endpoint. Robots.txt cannot permit or deny these callbacks.

Examples

During setup, Meta sends a GET challenge and the endpoint returns it only after the supplied verify token matches the app's stored value.
A Page field change produces a signed POST, and the receiver validates `X-Hub-Signature-256` before updating its local record.
Meta retries an unacknowledged notification, and the application recognizes that the enclosed update was already processed.

Frequently asked questions about Facebook Webhooks

Learn about AI visibility monitoring and how Promptwatch helps your brand succeed in AI search.

It is the subscription verification handshake. The endpoint compares `hub.verify_token` with its configured token and returns `hub.challenge` when they match.