A webhook with a subscription handshake and a mandatory signature check. Because the delivery carries only identifiers, the full lead is fetched from the Graph API with the page's decrypted token, including campaign, ad set and ad names for attribution. Every failed fetch is written to the intake event log with its error.
Also called: leadgen webhook · lead didn't come through · Facebook lead missing
- 1A subscription handshake echoes the challenge when the verify token matches.
- 2Deliveries are verified against the app secret over the raw body, compared safely.
- 3A page-to-account index is built once per batch from stored connections.
- 4The full lead is fetched with the page token and normalised through the shared field mapping.
- 5A fetch failure writes an intake event with verdict error so the miss is visible in the settings debugger.
The signature rule is stated absolutely: 'Signature is NON-NEGOTIABLE here — this endpoint creates pipeline data.' The hydration step exists because 'The webhook only carries ids — the answers live behind the Graph API.' And the failure logging has a purpose: 'a lead we could not pull is a lead we know we're missing, loudly.'
- An unsigned endpoint creating pipeline data would be forgeable.
- Delivery payloads carry no answers, only identifiers.
- A failed lead fetch would otherwise be a silent loss.
See it on your own jobs
Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.
or keep browsing features →