Verify token

The verify token is a secret string used only during the webhook verification handshake. It proves to Meta that the endpoint receiving its calls is really yours.

You choose it

There is no "correct" value — you invent it. Use a long, random string (a UUID or a generated password works well). It is unrelated to your access token.

Set it in three places — identically

The exact same value must appear in all three:

1. Callduck — Channels → WhatsApp, the Verify token field
2. Meta — WhatsApp → Configuration → Webhook → Verify token
3. Environment — WHATSAPP_VERIFY_TOKEN (Callduck falls back to this if the channel field is empty; the bundled default is callduck-verify-token)

> If even one character differs, verification returns 403 and Meta shows the webhook as unverified.

Security notes

• Treat it as a shared secret — keep it out of client code, screenshots, and public repos.
• It is not your message-signing secret. Signature verification of incoming payloads uses the separate app secret (X-Hub-Signature-256).
• Rotate it if leaked: pick a new value, update it in Callduck, Meta's config, and your env, then re-verify the webhook.

For the full webhook setup, see Webhook callback URL.