I'm debugging Instagram messaging webhooks with the current Instagram API and Instagram Login, rather than the older Facebook Page Login flow. The app is live, the business is verified, and instagram_business_manage_messages has been approved.
Synthetic webhook tests for messages, messaging_postbacks, and comments all reach the callback, and real comment events arrive normally. Outbound messages work, the Conversations API can read genuine incoming DMs, and both the app and Instagram account appear to have messages and messaging_postbacks enabled. However, real DMs and button postbacks never produce webhook requests. Our server logs every request before signature validation, so this is not a signing or application-processing issue.
The behavior is identical with two different Instagram Business accounts. I have regenerated tokens, reapplied subscriptions, confirmed that messages appear in the Primary inbox, and verified the callback with the dashboard's test events. Is there an additional account-level subscription, entitlement, review state, or dispatch setting required for real messaging events when using Instagram Login?
3 Answers
Since the Conversations API can retrieve the DM, Instagram is receiving the message; the failure is likely dispatch configuration rather than permissions or callback validation. I’d compare the account ID used in /{ig_user_id}/subscribed_apps with the account that owns the conversation, then verify the returned subscribed fields and token context. Repeat the same check for both accounts instead of assuming the dashboard subscription applies to them automatically.
The dashboard’s webhook test only proves that Meta can reach your callback; it does not necessarily subscribe the actual Instagram account to receive production events. Check the account-level subscription directly through the Instagram API, such as GET /{ig_user_id}/subscribed_apps, and verify that messages and messaging_postbacks are present there. If they are missing, apply the subscription with the appropriate Instagram user access token and then test again.
I ran into the same confusion. The app-level fields can look enabled while the specific Instagram Business account is not subscribed for real-time delivery. Confirm the live account’s subscribed_apps response rather than relying on the synthetic test controls. Conversations API access and successful outbound sends do not, by themselves, prove that inbound webhook delivery is enabled.
Related Questions
How To: Running Codex CLI on Windows with Azure OpenAI
Set Wordpress Featured Image Using Javascript
How To Fix PHP Random Being The Same
Why no WebP Support with Wordpress
Replace Wordpress Cron With Linux Cron
Customize Yoast Canonical URL Programmatically