如何针对Facebook应用特定用户阻止Webhook调用？

I’ve dealt with this exact scenario before, so let’s break down actionable steps to stop receiving webhook events from users whose accounts you’ve removed from your database:

1.主动撤销应用对特定用户的权限（模拟用户手动移除应用） #

The most direct way to replicate the "user removes app from Facebook settings" behavior is to use the Facebook Graph API to revoke your app’s permissions for the specific user. Here’s how:

• Revoke all permissions for a user: Send a DELETE request to this Graph API endpoint:

  DELETE /{user-id}/permissions
  

  This immediately removes all access your app has to the user’s data and stops Facebook from sending any future webhook events related to this user.

• Revoke specific permissions: If you only want to halt feed-related events (instead of revoking all access), target the relevant permission (e.g., pages_show_list or manage_pages, depending on your use case):

  DELETE /{user-id}/permissions/{permission-name}
  

  Note: You’ll need a valid user access token for this user (you should have stored this when they initially authorized your app). If the token has expired, use a long-lived token or refresh it if you have the refresh token on file.

2. Filter Webhook Events on Your End #

If you can’t revoke permissions right away (e.g., you no longer have the user’s access token), add a check in your webhook handler to ignore events from non-existent users:

• When a webhook event arrives, extract the user_id (or page_id for business page events) from the payload.
• Query your database to verify if this user/page is still active (exists and isn’t marked as expired/deleted).
• If the user/page doesn’t exist, discard the event immediately without processing it.

This is a quick stopgap to prevent wasted resources, even if you’re still receiving events from Facebook.

3. Handle Page-Specific Subscriptions (If Applicable) #

If your app is subscribed to events from business pages managed by the deleted user, you can unsubscribe your app from that specific page using:

DELETE /{page-id}/subscribed_apps

This stops all webhook events from that page, which is useful if the page is no longer associated with your service.

Key Notes #

• Revoking permissions via the Graph API is permanent (unless the user re-authorizes your app later), which matches the behavior of a user manually removing your app from their Facebook settings.
• Always store user access tokens securely when users first sign up—this lets you take action later if their account expires.

内容的提问来源于stack exchange，提问作者santoshthota