Overview
WhatsApp API Webhooks allow your application to receive real-time updates whenever important WhatsApp events occur. Instead of continuously checking the API for changes, your application automatically receives event notifications at a secure webhook URL.
SPRL allows you to configure your webhook endpoint, generate a webhook secret, choose which events you want to receive, and enable or disable webhook notifications from the Webhook settings page.
Good to Know:
Webhook configuration is available on supported subscription plans. Your webhook endpoint should be publicly accessible and able to receive HTTPS POST requests.
Open Webhook Settings
- Navigate to Dashboard → WhatsApp → API → Webhook.
- Open the Webhook Configuration page.
- Enter your webhook information.
- Select the events you want to receive.
- Enable webhook notifications.
- Save your configuration.
Webhook Configuration
| Setting | Description |
| Webhook Name | A descriptive name for your webhook configuration. |
| Webhook URL | The HTTPS endpoint that will receive webhook events. |
| Secret Key | Used to verify webhook requests using HMAC SHA256 signatures. |
| Generate | Create a secure webhook secret automatically. |
| Status | Enable or disable webhook notifications. |
Available Webhook Events
Choose the events that your application should receive.
| Event | Description |
| Message Received | Triggered when a customer sends a message. |
| Message Sent | Triggered after a message has been sent. |
| Message Delivered | Triggered when message delivery is confirmed. |
| Message Read | Triggered when a recipient reads a message. |
| Message Failed | Triggered if message delivery fails. |
| Message Replied | Triggered when a customer replies. |
| Conversation Started | Triggered when a new conversation begins. |
| Template Approved | Triggered when a template is approved. |
| Template Rejected | Triggered when a template is rejected. |
| Template Paused | Triggered when a template is paused. |
| Template Disabled | Triggered when a template is disabled. |
Webhook Security
Every webhook request includes security information that your application can use to verify the request.
| Header | Purpose |
| Content-Type | Identifies the request format. |
| User-Agent | Identifies the webhook sender. |
| X-Webhook-Event | Specifies the event type being delivered. |
| X-Webhook-Signature | Contains the HMAC SHA256 signature used to verify the request. |
Webhook Status
The Webhook Status panel provides information about your current webhook configuration.
| Status Item | Description |
| Last Tested | Most recent webhook test. |
| Last Success | Most recent successful webhook delivery. |
| Last Failure | Most recent failed webhook request. |
| Failure Count | Total number of failed webhook deliveries. |
Webhook Requirements
- Your webhook URL should use HTTPS.
- Your endpoint should accept HTTP POST requests.
- Your application should validate webhook signatures using the configured Secret Key.
- Your endpoint should respond with HTTP 200 after successfully processing a request.
- Save your configuration after changing events or settings.
Best Practices
- Generate a strong Secret Key and keep it confidential.
- Enable only the webhook events your application requires.
- Always verify webhook signatures before processing requests.
- Monitor the Webhook Status panel for failed deliveries.
- Use HTTPS to protect webhook traffic.
- Review webhook logs in your application if events are not being received.
Troubleshooting
My application isn't receiving webhook events
Verify that webhook notifications are enabled, your Webhook URL is correct, and your endpoint is publicly accessible.
Webhook requests are failing
Check your application logs, verify the endpoint returns an HTTP 200 response after processing requests, and review the Failure Count in the Webhook Status panel.
Signature verification is failing
Ensure your application uses the same Secret Key configured in the Webhook settings to validate the HMAC SHA256 signature.
I am not receiving every event
Confirm that the required event checkboxes are selected before saving your webhook configuration.
Frequently Asked Questions
What are webhooks used for?
Webhooks notify your application automatically whenever selected WhatsApp events occur.
Can I choose which events I receive?
Yes. You can select individual message, conversation, and template events from the Webhook Configuration page.
Why do I need a Secret Key?
The Secret Key allows your application to verify that incoming webhook requests are authentic using HMAC SHA256 signatures.
How can I tell if my webhook is working?
The Webhook Status panel displays the latest successful and failed webhook activity, along with the total failure count.
Learn More:
Continue with WhatsApp Pricing & Conversation Charges to understand subscription plans, Meta conversation pricing, and how WhatsApp billing works.
Tip: Subscribe only to the webhook events your application actually needs. Receiving fewer event types reduces unnecessary processing while making your integrations easier to maintain.