Sales Morgan Logo
Sales Morgan
Log in
Start 7-Day Free Trial
View SMTP Routing Guide

Official Meta Graph API OAuth & Webhook Integration

Official OAuth 2.0 authorization, HMAC-SHA256 signature validation, and encrypted token management

Sales Morgan connects to Instagram and Facebook using Meta's official Graph API OAuth 2.0 authentication flow. We do not use password scraping, unofficial private APIs, or browser cookie injection. This ensures compliance with Meta platform policies and protects your business accounts from restrictions.

1. Meta OAuth 2.0 Authorization Flow

When linking your Instagram Business or Creator account in the Sales Morgan dashboard:

  1. Click "Connect Instagram Account" in your Social Dashboard.
  2. You are securely redirected to Facebook's official OAuth dialog (https://www.facebook.com/v19.0/dialog/oauth).
  3. Authenticate with your Meta credentials directly on Meta's secure domain.
  4. Approve the requested permission scopes: instagram_basic, instagram_manage_messages, pages_show_list.
  5. Meta redirects back with a single-use authorization code and cryptographic state token verified by Sales Morgan.

2. Real-Time Webhook Verification

Inbound messages and comment triggers are delivered in real time via Meta Webhooks with full cryptographic verification:

  • HMAC-SHA256 Signatures: Every incoming payload includes an X-Hub-Signature-256 header validated against your App Secret.
  • Challenge Verification: Subscription endpoints verify challenge tokens on handshake using META_WEBHOOK_VERIFY_TOKEN.
  • Anti-Replay Protection: Webhook events are processed idempotently to prevent duplicate action dispatch.

3. Token Security & Encryption at Rest

OAuth tokens obtained through the handshake are protected by enterprise security standards:

  • Authenticated Symmetric Encryption: Tokens are encrypted using AES-256-GCM authenticated cipher mode before database persistence.
  • Decoupled Key Storage: Encryption keys are maintained in isolated system environments and decoupled from application storage.
  • Transient Memory Decryption: Tokens are decrypted temporarily in volatile memory only during active API synchronization and purged immediately afterwards.

Meta Platform Policy & Rate Limits

Sales Morgan strictly respects Meta's 24-hour messaging window and standard rate limits. Automated DM sequences trigger only in response to organic user interactions (such as post comments, keyword DMs, or story replies) in full accordance with Meta Platform Terms.

Open Social Dashboard →Meta Graph API Documentation