On this page
META AND ACCOUNTS
App secret
The app secret is the confidential key Meta issues to each Meta developer app. It is used to sign webhook payloads, to prove app identity when exchanging or debugging tokens, and to generate appsecret_proof values on API calls. It must never be exposed in client-side code or shared outside the app's owners.
webhook signaturesystem user tokenpermanent token
Why it matters
Whoever holds the app secret can forge webhook events for that app and, combined with a token, impersonate the app to Meta. Leaked secrets are a frequent cause of account compromise in self-built integrations. One Meta app has exactly one secret, so rotating it affects every WABA connected through that app at once.
In VGraple CRM
As a Tech Provider, VGraple CRM's own Meta app secret verifies every inbound webhook and is stored server-side only; customers never handle it. Businesses connecting their own Meta app (for example for Conversions API or a custom integration) enter the secret in Settings, where it is encrypted at rest and visible only to owners.