Gödi Sittes / 8 October 2026
From Facebook lead to CRM customer: a day of Meta debugging, permission dead ends and a successful backfill
Completed the production Facebook Lead Ads → Gödi Sittes CRM pipeline with signed webhook ingestion, Graph API retrieval, idempotent PostgreSQL processing and PWA push notifications. Four accessible historical leads were backfilled, and synthetic test records were cleaned up.
Situation
The Gödi Sittes CRM could already accept Facebook leadgen webhook requests, but that did not mean a customer appeared in the application. Meta's testing interface alternated between missing-permission and app-not-installed warnings, while the test delivery stayed pending for a long time. A valid HMAC signature and HTTP 200 response proved webhook receipt, not that Graph API would actually return the lead details. We also needed to preserve production stability throughout the investigation.
Approach
We isolated the webhook, token, form access and background-worker stages rather than changing everything at once. debug_token showed why a system-user token with numerous permissions was not enough in this context: the Page Access Token derived for the correct Facebook Page could enumerate both lead forms successfully. After safely updating the runtime token, the webhook persisted a leadgen identifier in the meta_lead_events queue, but the first test lead still returned HTTP 400 / code 100 / subcode 33 on direct Graph retrieval. Focused API checks separated a no-longer-accessible synthetic lead from a valid Page authorization problem. A fresh lead created through Meta's test_leads API returned the expected fields and was imported by the CRM worker on its first attempt; the customer card and mobile PWA push notification both appeared. One operational detour was more serious: a development make down command also stopped the production database container. We restored both services with the production Compose files and the existing persistent volume, then verified application health. Finally, after a database dump and dry-run preview, a paginated backfill queued four unique historical customer leads from two forms. Cleanup was limited to two identified test queue events and one synthetic CRM record.
Outcome
All four historical Facebook leads currently available through the API reached imported status. After removing the identified synthetic records, the Meta queue showed four imported items and no remaining failed events. The full tested path is now Facebook instant form → signed webhook → PostgreSQL queue → Graph API → CRM customer/callback task → PWA push. Deduplication uses the original Meta lead identifier, and we took a production database backup before the one-off historical import. The next lead from a real paid advertisement should still be observed as a final operational check.