Webhooks
Inbound channel webhook ingest, dedupe, and how it relates to the public API.
ChatinFlow Team
Official guide
Overview
ChatinFlow ingests provider webhooks (Meta, TikTok, Telegram, and others) into the messaging pipeline and emits product lifecycle events on private realtime channels for the dashboard.
When you build outbound integrations, prefer polling the API or listening to documented product events. Channel provider payloads are provider-specific and are not a stable public contract for third parties.
Inbound channel webhooks
Connect the channel first
OAuth or credential connect under Dashboard → Channels registers the webhook path and secrets. You do not manually paste Meta callback URLs for the first-party product.
Idempotent ingest
Provider deliveries are deduped using Idempotency-Key or provider message ids so retries do not double-create conversations.
Permission loss
If scopes are revoked, Channels surfaces reauth. Fix permissions before debugging “missing webhooks”.
Hardening
Heads up
Do not expose APP secrets
Webhook verification secrets and OAuth tokens stay server-side (envelope-encrypted). Never embed them in client apps.
Tip
Realtime for the desk
Inbox and automation lifecycle updates for signed-in members use private workspace channels (Echo/Reverb), not public webhook URLs.
Was this guide helpful?
Browse more in the library
Ready to put this
into practice?
Start building your first automation for free. No credit card required. Just connect your channel and launch in minutes.