Skip to main content
A WhatsApp source is a webhook source that also answers Meta’s handshake and checks Meta’s signature. You do not write any server code.
WhatsApp sources need a Pro project, because the Free plan has one source only.

​
Set up

1

Add the source

In your project, open Sources → Add source and pick WhatsApp Cloud API. hooksnode shows a Callback URL and a Verify token.
2

Paste the values into Meta

In Meta for Developers, open your app → WhatsApp → Configuration. Paste the Callback URL and the Verify token, then press Verify and save. Subscribe to the webhook fields you need, for example messages.
3

Paste the App Secret into hooksnode

In Meta, open App settings → Basic and copy the App Secret. Paste it into the source in hooksnode. From now on, hooksnode checks the X-Hub-Signature-256 header of each event.
4

Add a destination

Add the endpoint of your bot or support tool as a destination.

​
How it works

  • Handshake. Meta sends GET /p/<id>?hub.mode=subscribe&hub.verify_token=…&hub.challenge=…. hooksnode answers 200 with the challenge when the token matches, and 403 when it does not.
  • Signature. With an App Secret saved, an event with a wrong X-Hub-Signature-256 gets 401. Without an App Secret, hooksnode accepts unsigned events and the source page shows a warning.
  • Duplicates. Meta retries a failed delivery for up to 36 hours with the same body. hooksnode stores each body once, because it uses a hash of the body as the idempotency key.
Always save the App Secret. Without it, anyone who knows the URL can send fake events.

​
Settings