Meta Platform Integration — Connect with Bayezid

What this application does

Connect with Bayezid is a web development and digital marketing studio in Bangladesh. This application supports three things, and nothing else:

Messenger support for our own Facebook Page. Someone messages the Page with a question about our services and receives an answer — most of them written in advance, in Bangla and English.
Conversions API for our own website. Website events already reported by the Meta Pixel are also sent server-side, so a blocked browser event is not a lost conversion. Both copies carry the same event ID, so Meta counts one sale once.
Business Login for clients. A client who has hired us to manage their advertising connects their own Meta business assets so we can work on them, and disconnects whenever they choose.

It is not a consumer product, it has no app store listing, and it does not publish content on anyone's behalf.

Callback URLs

All four are served by a single Cloudflare Worker on bayezid-agency-api.sayadmdbayezidhosan.workers.dev. Every one verifies a Meta signature before it reads the request.

Purpose	URL	Verification
Webhook verification GET	`/api/messenger/webhook`	Answers `hub.challenge` only when `hub.verify_token` matches the configured value; 403 otherwise.
Webhook events POST	`/api/messenger/webhook`	`X-Hub-Signature-256`, HMAC-SHA256 over the raw request body, compared in constant time.
Deauthorize callback	`/api/facebook/deauthorize`	`signed_request`, HMAC-SHA256 over the encoded payload. An unsigned request changes nothing.
Data deletion request	`/api/facebook/data-deletion`	`signed_request`, as above. Returns a confirmation code and a status URL.

Related public URLs

Deletion status page — sayadbayezid.com/data-deletion-status.html, the address the deletion callback hands out with a confirmation code.
Client login — sayadbayezid.com/facebook-business-login.html, the only redirect URI this app uses.
Privacy policy — sayadbayezid.com/privacy-policy.html · Meta-specific policy
Terms — sayadbayezid.com/terms-of-service.html · Business integration & data policy

Why the API is on a workers.dev address. The API and the website are in separate Cloudflare accounts, and Cloudflare only permits a Worker custom domain when the zone and the Worker share an account. The Worker therefore answers on its own origin. It is the same business and the same operator; the website links to it throughout.

Webhook fields, and what each is used for

Subscribed on the Page object for our own Facebook Page. Nothing is subscribed that is not used.

Field	What we do with it
`messages`	Read the customer's question so the assistant can answer it.
`messaging_postbacks`	The Get Started button and menu taps, so a person can choose a service instead of typing.
`messaging_referrals`	Records which advertisement or link a conversation came from, so an ad's real cost per enquiry can be measured.
`messaging_optins`	Opt-ins through a plugin, recorded so consent is on file.
`message_echoes`	Stops the assistant talking over a person. When a human on our team answers from the Page inbox, the echo tells the application to stay out of that conversation.
`message_deliveries` · `message_reads`	Confirms a reply reached the customer, so a broken integration is visible rather than silent.
`message_reactions`	Recorded; never replied to.
`messaging_policy_enforcement`	How Meta tells us the Page is restricted. Recorded so it is not missed.

Events are stored as a small operational log: the message identifier, the Page identifier, the event type and whether a reply succeeded. Message text is not stored.

Permissions, and why each is needed

Permission	Why it is required
`pages_messaging`	To receive a message sent to our Page and to send the reply. Without it there is no Messenger support.
`pages_manage_metadata`	To subscribe the Page to the webhook fields above.
`pages_read_engagement`	To read the Page's own profile details used in replies.
`public_profile`	Business Login: to show a connecting client which account they signed in with.
`email`	Business Login: to contact the client about the work they hired us for.
`ads_management` · `ads_read`	Advertising clients only, on accounts they have granted us. Reading performance, and creating or adjusting campaigns we have been engaged to manage.
`business_management`	To see which assets a client has shared with us, so we work only on those.

Advertising work is scoped to accounts a client has explicitly shared. Nothing here reads or changes an advertising account that has not been granted to us through Meta Business Manager, and a client removes that access themselves at any time without asking us.

What is stored, and for how long

Data	Why	Kept
Page-scoped ID of someone who messages the Page	To reply to the right conversation and to know whether a colleague already answered.	Until deletion is requested
Name, phone, email and website — only when a person types them into the enquiry form and agrees	So we can call back about the work they asked about.	Until deletion is requested
Which advertisement a conversation came from	To measure which campaigns produce enquiries.	Until deletion is requested
Client access token, from Business Login	To manage the assets that client engaged us to manage.	Encrypted at rest; removed on deauthorisation
Website conversion events	Conversions API delivery, deduplicated against the browser Pixel.	Sent to Meta; a delivery receipt without personal data is retained

Message content is not stored. Contact details are never taken without the person being shown what will be kept and agreeing to it. Nothing collected here is sold, rented, or shared with any third party.

Deleting a person's data

Three routes, all of which work:

Through Facebook. Removing this app from a Facebook account sends a signed deletion request to /api/facebook/data-deletion. Everything held for that person is removed and a confirmation code is returned with a status URL.
By checking a code. sayadbayezid.com/data-deletion-status.html answers for a confirmation code. It is public on purpose: the person asking has just deleted their account and has nothing left to authenticate with.
By asking. info@sayadbayezid.com — say what to remove and it is removed.

Deletion covers every table that holds anything about that person — the stored connection, any enquiry they submitted, a half-finished form, and the conversation log. Each is cleared independently, so a problem with one cannot leave the others behind.

Security

Every Meta callback verifies its signature before acting. A forged request cannot delete, disconnect, or trigger anything.
Signature comparison is constant-time; a near-miss reveals nothing through timing.
Only HMAC-SHA256 is accepted. A request naming a weaker algorithm is refused rather than trusted.
Tokens and keys are stored as platform secrets, never in the code repository, never written to the database in plain text, and never returned by any endpoint or included in any error message.
Client access tokens are encrypted at rest.
The Conversions API token stays server-side and is never sent to a browser.
Contact details are returned only to an authenticated administrator, never in bulk, and never by a public endpoint.

How to verify this integration

Webhook verification — a GET to the webhook URL with the correct hub.verify_token returns the challenge; a wrong one returns 403.
Webhook events — a POST with a valid X-Hub-Signature-256 is accepted; without it, or with a wrong signature, it is refused and nothing is written.
Messenger — message the Page and a reply arrives. Reply from the Page inbox and the assistant stops for that conversation.
Deletion — remove the app from a Facebook account; the callback returns a confirmation code, and the status page confirms the removal for that code.

For anything not covered here, write to info@sayadbayezid.com and we will answer with whatever detail is needed.