Quick answer: A webhook is how the WhatsApp Cloud API tells your system that something happened. Meta's servers send a small data message, in JSON, to an address you set up whenever a customer writes to you, a message you sent changes status, or a template or account is updated. Without a working webhook, your chatbot, CRM or inbox hears nothing.
You may never write a webhook yourself, but if you run WhatsApp for business, you will depend on one every day. When messages seem to vanish, the cause is often here. For the background on the platform, see our guide to what the WhatsApp Business API is and how it works in India.
The idea in one paragraph
Sending a WhatsApp message through the API is a request from your system to Meta. Hearing back is the opposite direction: Meta has to push news to you, because your system cannot sit and ask every second. The address Meta pushes to is your webhook endpoint. You give Meta that address once, and from then on every event you subscribed to is delivered there.
What arrives through a webhook
According to Meta's Cloud API documentation, webhooks cover:
- Incoming messages from WhatsApp users. This is how a chatbot or an agent inbox sees what the customer wrote.
- The status of outgoing messages. This is how your system learns what happened to a message it sent.
- Call events, such as a call being connected or ended.
- Account, template and phone number updates. For example, a change in the status of a message template.
Our guide to WhatsApp message templates mentions why template status updates matter. Incoming messages are also what starts the 24-hour window described in our guide to the WhatsApp customer service window.
Why this matters to a business
- Chatbots and agents depend on it. No webhook, no incoming message, no reply.
- Delivery reports depend on it. If you want to know whether a campaign message was delivered, your system reads it from message status updates.
- CRM records depend on it. Lead capture from WhatsApp chats is built on incoming message events.
- Account health depends on it. Template and account updates tell you when something needs attention. See also our guide to WhatsApp messaging limits and quality rating, where Meta also notifies by webhook and email.
How it is set up
In Meta's App Dashboard, you subscribe to the webhook fields you want. Permissions matter: Meta's documentation says the whatsapp_business_messaging permission is needed for messages and calls, and whatsapp_business_management for other webhooks. The address itself is a web address on your side, or your provider's side, that accepts the data. Meta's page leaves the details of creating the endpoint to a separate document.
If you use a provider, they usually set this up and show you the result in their dashboard. That is one of the practical reasons to use one, and our guide to choosing a WhatsApp Business solution provider lists what to ask.
What happens when your endpoint is down
Meta's documentation says that if your endpoint returns an error or delivery fails, Meta retries with decreasing frequency for up to seven days. Two consequences follow:
- Notifications can arrive late, after your endpoint recovers.
- Duplicates are possible. The same event may be delivered more than once, so your system must handle repeats without sending a second reply or creating a second lead.
Security in brief
Meta's page notes that its IP addresses change from time to time, and it describes mutual TLS as a supported option, preferred over allow-listing addresses. Payloads can be up to 3 MB. These are matters for your developer or provider, but it is fair to ask them how the endpoint is secured.
If webhooks stop arriving
- Check that your endpoint is online and accepting requests.
- Send a test notification from the App Dashboard.
- Make sure the app is in Live mode. Meta says some webhooks are not sent in Dev mode.
- Check that you subscribed to the right fields and have the right permissions.
- Look at your logs for errors or repeated deliveries.
Our guide to common WhatsApp Business API errors covers other errors you may see. Ask any provider, including us through our WhatsApp API and chatbot service, how webhooks are set up and monitored for your account.
Frequently asked questions
What is a webhook in simple terms?
A message that Meta's servers send to an address you provide whenever something happens, such as a customer writing to you.
Do I need developers to use webhooks?
If you use a provider's platform, they handle it. If you integrate directly with the Cloud API, you or your developer must set up the endpoint.
Why do I sometimes get the same notification twice?
Meta retries when it does not get a clean reply from your endpoint, which can produce duplicates. Systems should be built to ignore repeats.
How long does Meta keep retrying?
Meta's documentation says up to seven days, with decreasing frequency.
Do webhooks work in test mode?
Some do not. Meta says some webhooks are not sent while the app is in Dev mode.
Sources checked
- Meta for Developers, WhatsApp Cloud API: webhooks overview (notification types, permissions, retries, payload size, mTLS, troubleshooting), read 2 November 2026. The page did not describe the verification handshake or payload signatures, so this article does not.
More in WhatsApp Business API guides.
Written by Rohit Jadhav. Last reviewed 2 November 2026.