Loading

POST

/webhooks

Webhook Events

Relayno forwards all Meta webhook events to your endpoint with HMAC-SHA256 signature verification. Use webhooks to receive incoming messages and delivery receipts in real time.

How it works

Meta calls GET /webhooks to verify your endpoint (see Endpoint verification below).

Relayno gateway receives POST /webhooks from Meta, verifies the HMAC, then forwards the raw payload to your backend.

Your backend re-verifies the signature and processes the event.

Webhook endpoint

GET

https://api.relayno.com/webhooks

Meta hub verification

POST

https://api.relayno.com/webhooks

Incoming events

Endpoint verification

When you register your webhook URL, Meta sends a GET request with a challenge token. Your endpoint must echo back the challenge value as plain text with HTTP 200.

# Meta calls this to verify your webhook endpoint:
GET https://api.relayno.com/webhooks?hub.mode=subscribe&hub.verify_token=YOUR_VERIFY_TOKEN&hub.challenge=abc123

# Gateway forwards to your backend, which responds with hub.challenge
# If the response is not hub.challenge (plain text), Meta rejects the endpoint.

Signature verification

Every POST carries an X-Hub-Signature-256 header — HMAC-SHA256 of the raw body signed with your META_APP_SECRET. Always verify before processing.

Read the raw bytes before parsing JSON. Parsers may canonicalize the body, changing whitespace and breaking the signature. Always compute HMAC on the unparsed request body.

# The gateway adds X-Hub-Signature-256 to every POST:
POST /webhooks HTTP/1.1
X-Hub-Signature-256: sha256=abc123...
Content-Type: application/json

{"object":"whatsapp_business_account","entry":[...]}

Event payloads

All events follow the Meta Webhooks envelope. Check entry[].changes[].value for message and status data.

Incoming message

// Message received event
{
  "object": "whatsapp_business_account",
  "entry": [{
    "id": "BUSINESS_ACCOUNT_ID",
    "changes": [{
      "value": {
        "messaging_product": "whatsapp",
        "metadata": { "display_phone_number": "15551234567", "phone_number_id": "12345" },
        "contacts": [{ "profile": { "name": "Alice" }, "wa_id": "212600000000" }],
        "messages": [{
          "from": "212600000000",
          "id": "wamid.xxx",
          "timestamp": "1718000000",
          "text": { "body": "Hi there!" },
          "type": "text"
        }]
      },
      "field": "messages"
    }]
  }]
}

Delivery status update

// Delivery status update
{
  "object": "whatsapp_business_account",
  "entry": [{
    "id": "BUSINESS_ACCOUNT_ID",
    "changes": [{
      "value": {
        "statuses": [{
          "id": "wamid.xxx",
          "recipient_id": "212600000000",
          "status": "delivered",    // "sent" | "delivered" | "read" | "failed"
          "timestamp": "1718000005",
          "conversation": { "id": "CONV_ID", "expiration_timestamp": "1718086400" }
        }]
      },
      "field": "messages"
    }]
  }]
}

Status values

sent

Message accepted by WhatsApp servers.

delivered

Message delivered to the recipient's device.

read

Recipient opened the message (read receipts enabled).

failed

Delivery failed. Check errors[] in the payload for details.

Best practices

Respond with HTTP 200 immediately — do heavy processing in a background queue. Meta retries events for up to 24 hours if your endpoint returns non-200.

Deduplicate by message ID. Meta may deliver the same event more than once.

Never trust the payload without verifying the HMAC signature.

Use idempotent handlers — a message may arrive multiple times in rare cases.

Set a short response timeout (< 5 s). Long-running handlers cause retry storms.

Relayno — the all-in-one business platform · Stock · HMS · WhatsApp · Invoices · Emails

Relayno

Pricing

Operations

Stock

Track inventory, warehouses and stock movements in real time.

Invoices

Quotes, invoices, payments and tax — all handled.

Communication

Shared team inbox, campaigns and the official WhatsApp API.

Emails

Send, automate and track transactional and marketing email.

Hospitality

HMS

Hotel management: reservations, front desk, housekeeping, channel manager and billing.

WordPress Plugins

WhatsApp for WordPress

Add a WhatsApp chat button, shared inbox and the official API to any WordPress site.

WooCommerce ↔ Relayno Stock

Soon

Sync WooCommerce products, orders and inventory with the Relayno stock app in real time.

Reservations for WordPress

Soon

Let visitors book appointments and tables right from your WordPress pages.

Social

Facebook Auto-Posting

Soon

Schedule and auto-publish your products and updates to Facebook.

Instagram Auto-Posting

Soon

Schedule and auto-publish your products and updates to Instagram.

ERP

Odoo Stock Management

Soon

Two-way sync of inventory and stock movements with your Odoo instance.

REST APIs

WhatsApp API

Send messages, receive webhooks, manage sessions.

Stock API

Soon

Inventory and stock management REST API.

HMS API

Soon

Hotel management REST API.

How to use

How to use our apps

Step-by-step guides for every Relayno product.

Company

About

Relayno started as a WhatsApp gateway for one shop. It grew into the platform that shop wished existed.

Careers

Small team, real users, short feedback loop. If you want your work in production this month, this is that kind of place.

Contact

Pick the route that matches what you need — they go to different people.

POST

/webhooks

Webhook Events

Relayno forwards all Meta webhook events to your endpoint with HMAC-SHA256 signature verification. Use webhooks to receive incoming messages and delivery receipts in real time.

How it works

Meta calls GET /webhooks to verify your endpoint (see Endpoint verification below).

Relayno gateway receives POST /webhooks from Meta, verifies the HMAC, then forwards the raw payload to your backend.

Your backend re-verifies the signature and processes the event.

Webhook endpoint

GET

https://api.relayno.com/webhooks

Meta hub verification

POST

https://api.relayno.com/webhooks

Incoming events

Endpoint verification

When you register your webhook URL, Meta sends a GET request with a challenge token. Your endpoint must echo back the challenge value as plain text with HTTP 200.

# Meta calls this to verify your webhook endpoint:
GET https://api.relayno.com/webhooks?hub.mode=subscribe&hub.verify_token=YOUR_VERIFY_TOKEN&hub.challenge=abc123

# Gateway forwards to your backend, which responds with hub.challenge
# If the response is not hub.challenge (plain text), Meta rejects the endpoint.

Signature verification

Every POST carries an X-Hub-Signature-256 header — HMAC-SHA256 of the raw body signed with your META_APP_SECRET. Always verify before processing.

Read the raw bytes before parsing JSON. Parsers may canonicalize the body, changing whitespace and breaking the signature. Always compute HMAC on the unparsed request body.

# The gateway adds X-Hub-Signature-256 to every POST:
POST /webhooks HTTP/1.1
X-Hub-Signature-256: sha256=abc123...
Content-Type: application/json

{"object":"whatsapp_business_account","entry":[...]}

Event payloads

All events follow the Meta Webhooks envelope. Check entry[].changes[].value for message and status data.

Incoming message

// Message received event
{
  "object": "whatsapp_business_account",
  "entry": [{
    "id": "BUSINESS_ACCOUNT_ID",
    "changes": [{
      "value": {
        "messaging_product": "whatsapp",
        "metadata": { "display_phone_number": "15551234567", "phone_number_id": "12345" },
        "contacts": [{ "profile": { "name": "Alice" }, "wa_id": "212600000000" }],
        "messages": [{
          "from": "212600000000",
          "id": "wamid.xxx",
          "timestamp": "1718000000",
          "text": { "body": "Hi there!" },
          "type": "text"
        }]
      },
      "field": "messages"
    }]
  }]
}

Delivery status update

// Delivery status update
{
  "object": "whatsapp_business_account",
  "entry": [{
    "id": "BUSINESS_ACCOUNT_ID",
    "changes": [{
      "value": {
        "statuses": [{
          "id": "wamid.xxx",
          "recipient_id": "212600000000",
          "status": "delivered",    // "sent" | "delivered" | "read" | "failed"
          "timestamp": "1718000005",
          "conversation": { "id": "CONV_ID", "expiration_timestamp": "1718086400" }
        }]
      },
      "field": "messages"
    }]
  }]
}

Status values

sent

Message accepted by WhatsApp servers.

delivered

Message delivered to the recipient's device.

read

Recipient opened the message (read receipts enabled).

failed

Delivery failed. Check errors[] in the payload for details.

Best practices

Respond with HTTP 200 immediately — do heavy processing in a background queue. Meta retries events for up to 24 hours if your endpoint returns non-200.

Deduplicate by message ID. Meta may deliver the same event more than once.

Never trust the payload without verifying the HMAC signature.

Use idempotent handlers — a message may arrive multiple times in rare cases.

Set a short response timeout (< 5 s). Long-running handlers cause retry storms.

Relayno

The all-in-one business platform. Run every team and module from a single login.

Modules

Stock HMS WhatsApp Invoices Emails

Company

About Careers Contact Privacy Terms

Resources

Docs Blog Status Support