WhatsApp Webhook Integration India 2026: Complete Setup Guide for Business API

Every WhatsApp Business API integration in India needs webhooks to work in real time. Without them, your system polls the API every 10 seconds asking "Any new messages?" — slow, wasteful, and banned by most BSPs. Webhooks flip this: Meta calls your server the instant a customer sends a message, clicks a button, or a delivery status changes. This guide shows how to build a webhook endpoint from scratch, verify Meta signatures securely, and handle the 6 most common event types Indian businesses use.

What is a WhatsApp Webhook and Why It Matters

A webhook is a URL you give to Meta. When something happens — a customer sends "Hi", your message is delivered, someone clicks a Quick Reply button — Meta sends an HTTP POST request to your URL with the event data. Your server processes it instantly and responds (send a reply, update a database, trigger a CRM workflow).

Without webhooks, you poll: your code calls GET /messages every 5-10 seconds asking if anything is new. This is slow (5-10 second delay before you see a customer message), expensive (thousands of wasted API calls per day), and most BSPs block it. Webhooks deliver events in under 2 seconds, use zero polling quota, and are the only supported method for real-time chatbots and support automation.

How WhatsApp Webhooks Work: The 3-Step Flow

Setting Up a WhatsApp Webhook: Step-by-Step

Step 1: Deploy an HTTPS Endpoint

Meta requires HTTPS (not HTTP). Deploy your webhook at a publicly accessible URL like https://api.yourbusiness.com/whatsapp/webhook. Here is a minimal Node.js Express endpoint:

const express = require('express');
const crypto = require('crypto');
const app = express();

app.use(express.json());

const VERIFY_TOKEN = 'your-random-verify-token-12345';
const APP_SECRET = 'your-meta-app-secret';

// Verification endpoint (Meta calls this once during setup)
app.get('/whatsapp/webhook', (req, res) => {
  const mode = req.query['hub.mode'];
  const token = req.query['hub.verify_token'];
  const challenge = req.query['hub.challenge'];

  if (mode === 'subscribe' && token === VERIFY_TOKEN) {
    console.log('Webhook verified');
    res.status(200).send(challenge);
  } else {
    res.sendStatus(403);
  }
});

// Event receiver endpoint
app.post('/whatsapp/webhook', (req, res) => {
  const signature = req.headers['x-hub-signature-256'];

  // Verify signature
  const expectedSignature = 'sha256=' + crypto
    .createHmac('sha256', APP_SECRET)
    .update(JSON.stringify(req.body))
    .digest('hex');

  if (signature !== expectedSignature) {
    console.error('Invalid signature');
    return res.sendStatus(403);
  }

  // Process event
  const event = req.body;
  console.log('Received webhook:', JSON.stringify(event, null, 2));

  // Your business logic here
  // - Save message to database
  // - Trigger chatbot response
  // - Update delivery status

  res.sendStatus(200);
});

app.listen(3000, () => console.log('Webhook listening on port 3000'));

Step 2: Register Webhook in Meta Business Manager

1. 1. Go to Meta Business Manager → WhatsApp → API Setup
2. 2. Under "Webhooks", click Edit
3. 3. Paste your webhook URL (https://api.yourbusiness.com/whatsapp/webhook)
4. 4. Enter the verify token (must match VERIFY_TOKEN in your code)
5. 5. Click Verify and Save
6. 6. Subscribe to events: messages, message_status, message_reaction

Meta calls your GET endpoint with a verification challenge. If your code returns the challenge correctly, the webhook is registered.

Step 3: Test by Sending a Message

Send a WhatsApp message to your Business API number from your phone. Within 1-2 seconds, your webhook endpoint should receive a POST request with the message payload. Check your server logs — if you see the JSON event printed, the webhook is working.

WhatsApp Webhook Event Types You Will Receive

Security Best Practices: Verifying Webhook Signatures

Anyone can POST to your webhook URL. Without signature verification, attackers could send fake events, inject spam messages, or trigger unauthorized actions. Meta signs every request with HMAC SHA-256 using your app secret. Always verify before processing.

Common Webhook Problems and How to Fix Them

Example: Auto-Reply Chatbot Using Webhooks

Here is a simple auto-reply flow: customer sends "Hi", your webhook receives it, calls WhatsApp API to send a reply template within 1 second.

app.post('/whatsapp/webhook', async (req, res) => {
  // Verify signature (code from earlier)
  // ...

  const event = req.body;
  if (event.entry?.[0]?.changes?.[0]?.value?.messages) {
    const message = event.entry[0].changes[0].value.messages[0];
    const from = message.from; // Customer phone number
    const text = message.text?.body;

    if (text?.toLowerCase() === 'hi') {
      // Send auto-reply via WhatsApp API
      await fetch('https://graph.facebook.com/v20.0/YOUR_PHONE_ID/messages', {
        method: 'POST',
        headers: {
          'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
          'Content-Type': 'application/json',
        },
        body: JSON.stringify({
          messaging_product: 'whatsapp',
          to: from,
          type: 'text',
          text: { body: 'Hello! How can we help you today?' },
        }),
      });
    }
  }

  res.sendStatus(200);
});

Do I Need Webhooks for Every WhatsApp API Use Case?

Almost always yes. If you send one-way broadcasts (no replies expected), you can skip webhooks — but you lose delivery status tracking and cannot debug failed sends. For chatbots, support automation, order updates, or any two-way conversation, webhooks are mandatory. Polling is too slow and most BSPs block it.

If you use a no-code tool like WhatSender, webhook setup is automatic — the platform handles endpoint deployment, signature verification, and event routing for you. You just configure business logic in the dashboard (e.g., "If user says X, reply with Y").

Webhook Setup Checklist

Webhooks are the backbone of every real-time WhatsApp integration. Deploy an HTTPS endpoint, verify signatures, subscribe to the right events, and you unlock instant chatbot responses, delivery tracking, and automated workflows that work 24/7 without polling waste.