Webhooks.

[romerocox]

Hello everyone, thanks for the awesome job.

I have just setup this API and it's working flawlessly. The only thing I didn't fully understood was how to verify the webhook.

I keep getting:

I tried with endpoints:

/wa_hook.php
/wa_hook

with and without .htaccess
on my webhook, I only added the following for testing purposes:

<?php

// Log the received data
$logFile = "logs.txt";
if (file_put_contents($logFile, "Test " . "\n", FILE_APPEND) === false) {
    error_log("Unable to write to log file: $logFile");
    http_response_code(500);
    echo json_encode(['error' => 'Internal Server Error']);
    exit;
}


http_response_code(200);
?>

Any help would be appreciated.

[romerocox]

For those who faces a similar issue, resolution is to:

<?php
// Replace 'YOUR_VERIFY_TOKEN' with the token you set in the webhook configuration on the platform
$VERIFY_TOKEN = 'YOUR_VERIFY_TOKEN';

// Retrieve the request method
$requestMethod = $_SERVER['REQUEST_METHOD'];

if ($requestMethod === 'GET') {
    // Parse the query parameters
    $mode = $_GET['hub_mode'] ?? '';
    $token = $_GET['hub_verify_token'] ?? '';
    $challenge = $_GET['hub_challenge'] ?? '';

    // Check if the mode and token are correct
    if ($mode === 'subscribe' && $token === $VERIFY_TOKEN) {
        // Respond with the challenge token from the request
        http_response_code(200);
        echo $challenge;
    } else {
        // Respond with '403 Forbidden' if verify tokens do not match
        http_response_code(403);
        echo 'Forbidden';
    }
    exit;
} elseif ($requestMethod === 'POST') {
    // Handle incoming webhook data (this is where you process messages)
    $input = file_get_contents('php://input');
    // Log the received data for debugging
    $logFile = "logs.txt";
    file_put_contents($logFile, $input . "\n", FILE_APPEND);

    // Respond with a 200 OK to acknowledge receipt of the event
    http_response_code(200);
    echo 'EVENT_RECEIVED';
    exit;
} else {
    // Respond with '405 Method Not Allowed' for other request methods
    http_response_code(405);
    echo 'Method Not Allowed';
    exit;
}
?>

[aindot]

use Netflie\WhatsAppCloudApi\WebHook;

 public function index(Request $r)
    {
        $webhook = new WebHook();

        return $webhook->verify($r->all(), config('app.w_verify_token'));
    }

The challenge is only every used once, to really protect the endpoint you must scramble the webhook.

also you should only whitelist certain ip's to call the webhook:

https://developers.facebook.com/docs/whatsapp/cloud-api/guides/set-up-webhooks/#ip-addresses

and this is the API route

Route::apiResource(config('app.w_end_url'), WhatsAppController::class)
->except(['show', 'update', 'destroy']);