Before you start
- Your site runs on a public HTTPS domain. Meta refuses plain http:// for login and webhooks.
- You can log in to Replyloop as an installation admin (the account created in the installer).
- You have a Facebook profile that is an admin of the Facebook Page you want to automate.
- Your Instagram account is a Business or Creator account, linked to that Facebook Page (Instagram app → Settings → Account type and tools).
-
The cron job is set up, so queued replies are sent:
* * * * * php artisan schedule:run.
Create the Meta app
- Go to developers.facebook.com/apps and press Create app.
- Choose Other, then the app type Business. Give it your brand name and pick your Business portfolio if you have one.
- On the app dashboard, add these products: Facebook Login for Business, Webhooks, Messenger, and Instagram (choose “API setup with Facebook login”).
- In App settings → Basic, fill in the App domain, Privacy policy URL, and Terms of service URL. Replyloop has both pages built in; Settings → Meta app shows their addresses.
- In Facebook Login for Business → Configurations, press Create configuration: name it, choose User access token, and tick every permission listed under “Permissions and why” below. Copy the Configuration ID into Settings → Meta app. Business apps need this so the login screen asks for the right permissions.
Where each value comes from
Values flow in both directions. Two come from Meta into Replyloop. The rest are shown in Replyloop under Settings → Meta app, with copy buttons, and go into Meta.
| Value | Find it in | Paste it into |
|---|---|---|
| App ID | Meta: App settings → Basic (also at the top of the dashboard) | Replyloop: Settings → Meta app → App ID |
| App Secret | Meta: App settings → Basic → App secret → Show (asks for your Facebook password) | Replyloop: Settings → Meta app → App Secret |
| Login configuration ID | Meta: Facebook Login for Business → Configurations (create one with a User access token) | Replyloop: Settings → Meta app → Login configuration ID |
| App domain, Privacy policy URL, Terms URL | Replyloop: Settings → Meta app | Meta: App settings → Basic |
| Valid OAuth Redirect URI | Replyloop: Settings → Meta app | Meta: Facebook Login for Business → Settings → Valid OAuth Redirect URIs |
| Webhook callback URL | Replyloop: Settings → Meta app | Meta: Webhooks → Instagram and Page → Callback URL |
| Webhook verify token | Replyloop: Settings → Meta app (generated for you) | Meta: Webhooks → Verify token, next to the callback URL |
| Data deletion request URL | Replyloop: Settings → Meta app | Meta: App settings → Basic → Data deletion instructions → Data deletion callback URL |
| Deauthorize callback URL | Replyloop: Settings → Meta app | Meta: Facebook Login for Business → Settings → Deauthorize callback URL |
| Page access tokens | Never typed by hand | Created automatically when you press Continue with Facebook, and stored encrypted |
Press Save and verify with Meta after pasting the App ID and App Secret. Replyloop asks Meta for an app token with them and only saves them if Meta accepts. The App Secret is encrypted with your APP_KEY.
Permissions and why
The Continue with Facebook screen asks for these. Use the descriptions when Meta’s App Review asks how each one is used.
pages_show_list- Lists the Facebook Pages you manage so you can choose which ones to connect.
pages_manage_metadata- Subscribes the chosen Page to comment and message webhooks.
pages_read_engagement- Reads Page posts and comments so the right automation can answer them.
pages_manage_engagement- Posts the short public reply under a Facebook comment.
pages_messaging- Sends the private reply and follow-up DMs on Messenger.
instagram_basic- Reads the Instagram profile and recent posts shown on the account page.
instagram_manage_comments- Reads Instagram comments and posts the public reply.
instagram_manage_messages- Sends the private reply and follow-up DMs on Instagram.
business_management- Finds Pages and Instagram accounts owned through Business Manager.
Webhooks
- In Meta, open Webhooks. Choose the Instagram object, press Subscribe to this object, and paste the callback URL and verify token from Replyloop. Meta calls your site once to check the token.
- Subscribe the Instagram object to
comments,messages, andmessaging_postbacks. Story replies and story mentions arrive throughmessages. - Repeat for the Page object, and subscribe to
feed,messages, andmessaging_postbacks. - You don’t subscribe each Page by hand. Replyloop does that when you connect it.
Every delivery is checked against the X-Hub-Signature-256 header with your App Secret. Deliveries that fail the check are rejected and listed under Settings → Meta app → Webhook deliveries.
Connect accounts
- Open Accounts and press Continue with Facebook.
- Log in with the Facebook profile that manages your Page. When Meta asks which Pages and Instagram accounts to share, select them, and leave every permission ticked.
- Back in Replyloop, tick the Instagram accounts and Pages that should reply, then press Connect selected.
- Open the account. Its recent posts load straight from Meta. Press Check connection to confirm the token and webhooks.
Test it
- Create an automation, or press Automate this post on one of your posts. Add a keyword such as
LINKand turn it on. - From a different Instagram account, comment
LINKon that post. Meta does not send events for your own comments. - Within a few seconds you’ll see the public reply under the comment and the DM in the other account’s inbox. The automation page shows the conversation, and Activity shows the run.
- Nothing happened? Look at Settings → Meta app → Webhook deliveries. No row means Meta isn’t sending; a row with “Replies started: 0” means no automation matched.
While the app is in Development mode, only people with a role on the app (Admins, Developers, Testers under App roles) trigger webhooks and can connect. Add the second test account as a Tester.
App Review and going live
- Complete Business verification for your Business portfolio. Meta requires it for advanced access.
- In App Review → Permissions and features, request Advanced access for each permission listed above, using the descriptions from this guide.
- Record a short screencast for each permission: Continue with Facebook, choosing accounts, creating an automation, commenting from another account, and the DM arriving.
- When approved, switch the app from Development to Live at the top of the dashboard. Now any customer can connect their own accounts.
Troubleshooting
“Meta rejected these credentials”
The App ID and App Secret are from different apps, or the secret was reset. Copy both again from App settings → Basic.
Meta says the callback URL could not be verified
The site must be on HTTPS and reachable from the internet, and the verify token must match the one in Settings exactly.
No Pages appear after signing in
You must be an admin of the Page, and you must select it in the Meta dialog. Instagram accounts appear only when linked to that Page.
Deliveries show “Rejected: bad signature”
The App Secret saved here belongs to a different app than the one sending webhooks. Save the right secret.
Comments arrive but no DM is sent
Check that the cron job runs. Then open Activity: a failed run shows Meta’s error message and a Retry button.
An account shows “Needs reconnect”
The token expired, a password changed, or the app was removed in Facebook settings. Press Reconnect and sign in again.
Only my own team can connect
The app is still in Development mode. Finish App Review and switch it to Live.
A run fails with “Outside Meta’s messaging window”
Meta only allows messages within 24 hours of the person’s last message, and a private reply within 7 days of the comment. That one run fails; the account stays connected and other people still get replies.
Someone commented twice but got one DM
The automation’s limit is set to once a day or once per person. Change it under Limits when editing the automation.
A comment with the keyword got no reply
It may contain one of the automation’s skip words, the automation may have passed its end date, or it may be paused.
Story mentions don’t trigger anything
Story mentions are Instagram only, and need the messages field on the Instagram webhook. Check Settings → Meta app → Webhook deliveries to see whether Meta sent the event.