Webhook

Fields a comment-to-DM tool uses

comments and live_comments need the instagram_business_basic and instagram_business_manage_comments permissions, and with Instagram Login mentions arrive inside the comments notification. messages covers DMs, story replies and story mentions, and messaging_postbacks reports button taps. Both need instagram_business_manage_messages.

Requirements

The app must be Live to receive notifications for its users, and the account that owns the media must be public, because private accounts do not receive comment or mention notifications. Meta signs every payload with a SHA256 signature in the X-Hub-Signature-256 header, which the server should check against the app secret before trusting the event.

Delivery and retries

If a delivery fails, Meta retries right away and then a few more times with decreasing frequency over 36 hours, after which the update is dropped. Notifications can come in batches of up to 1,000 updates, the same event can arrive twice, and Meta keeps no history, so the server has to store and deduplicate events itself. Elevion stores each event once by its ID and also checks recent posts for comments a notification may have missed.

Sources