Docs

Quickstart

Connect Instagram, pick a niche, go live. You do every step yourself in the dashboard, with no code.

Before you start

• An Instagram professional account, Business or Creator. A personal account can't be connected. You don't need a Facebook Page.
• An invite. Instagram connection is in early access, by invite: ask for yours.

Steps

1. Sign up. Create your account with the email the invite came to.
2. Connect Instagram. In Settings, open Channels and log in with Instagram. Allow Mastak to see your basic profile and to read and answer your comments and messages.
3. Pick your niche. Choose your kind of business and its playbook: how the chat opens, what it asks and when it hands the buyer to you.
4. Fill in your business card. Prices, address, opening hours and the answers you give every day. Add PDFs, links or text to the knowledge base. The AI answers only from what is here.
5. Turn the funnel on. Choose the posts and the code word. A comment with that word opens a private DM and the AI takes it from there.
6. Test it in the simulator. Play the buyer: push on price, ask for a person, ask something the card doesn't cover. Adjust, then let real buyers in.

Want leads in your own tools too? Add a webhook (below) or connect Google Sheets in Settings, Integrations.

Webhooks

Mastak sends a POST with a JSON body to your HTTPS address each time a lead changes. Point it at your own endpoint or your CRM.

Set it up

1. Add the address. In Settings, open Integrations, add a webhook and paste your URL. It has to start with https://.
2. Copy the secret. Mastak creates a signing secret and shows it once. Store it on your server, for example as MASTAK_WEBHOOK_SECRET.
3. Check the connection. The check sends a test event named webhook.test, signed the same way, so you can see it arrive.

Headers

Events

Payload

An example lead.qualified body. The values are made up.

{
  "event": "lead.qualified",
  "eventId": "3f6c1e2a-8b4d-4c55-9a1e-2d7b0c9e4f10",
  "timestamp": "2026-11-07T15:42:10.000Z",
  "conversationId": "8d0e5b7c-2f1a-4e6b-9c3d-5a4f7e1b2c90",
  "channel": "instagram",
  "niche": "med-spa",
  "stage": "qualified",
  "contact": {
    "peerId": "17841400000000000",
    "username": "jess.moves",
    "name": "Jess",
    "phone": null,
    "email": "[email protected]"
  },
  "qualification": {
    "service": "Lip filler",
    "when": "Next week"
  },
  "summary": "First visit. Asked about price and downtime. Prefers Thursday after 5 pm.",
  "leadStatus": "qualified",
  "temperature": "warm",
  "handoffReason": null,
  "card": {
    "need": "Lip filler, first time",
    "budget": "Around the listed price",
    "timeline": "Next week",
    "objections": ["Worried about swelling"],
    "manualSteps": ["Confirm Thursday 5:30 pm"],
    "buyerType": "b2c",
    "readyLead": false,
    "contact": "[email protected]"
  }
}

Optional fields can be missing. Ignore fields you don't recognise: new ones may be added.

Delivery and retries

• Answer with any 2xx status within 10 seconds and the delivery counts.
• On a timeout, a 5xx, a 408 or a 429, Mastak tries again after 1, 2, 4 and 8 minutes, five attempts in all.
• Any other 4xx, a 401 for a bad signature included, stops the retries for that event.

Check the signature

Do this before you trust a request:

1. Check the time. Reject the request if X-Mastak-Timestamp is more than 300 seconds away from your clock, in either direction.
2. Rebuild the signature. HMAC SHA-256 over the timestamp, a dot and the raw body, keyed with your secret, as hex, with sha256= in front.
3. Compare safely. Compare it with X-Mastak-Signature in constant time. Use the raw body as received: parsing the JSON and printing it again changes the bytes.

Node

// Node 18 or newer, no packages needed
const http = require("node:http");
const crypto = require("node:crypto");

const SECRET = process.env.MASTAK_WEBHOOK_SECRET;
const seen = new Set(); // keep event ids in your database in production

function verify(rawBody, timestamp, signature) {
  const now = Math.floor(Date.now() / 1000);
  if (!/^\d+$/.test(timestamp || "")) return false;
  if (Math.abs(now - Number(timestamp)) > 300) return false;
  const expected = "sha256=" + crypto
    .createHmac("sha256", SECRET)
    .update(timestamp + "." + rawBody)
    .digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature || "");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

http.createServer((req, res) => {
  let raw = "";
  req.setEncoding("utf8");
  req.on("data", (chunk) => (raw += chunk));
  req.on("end", () => {
    const ok = verify(
      raw,
      req.headers["x-mastak-timestamp"],
      req.headers["x-mastak-signature"]
    );
    if (!ok) return res.writeHead(401).end();

    const id = req.headers["x-mastak-event-id"];
    if (id && seen.has(id)) return res.writeHead(200).end(); // a retry
    if (id) seen.add(id);

    const event = JSON.parse(raw);
    console.log(event.event, event.contact.username, event.leadStatus);
    res.writeHead(200).end();
  });
}).listen(3000);

Python

# Python 3, standard library only
import hashlib
import hmac
import os
import time

SECRET = os.environ["MASTAK_WEBHOOK_SECRET"].encode()


def verify(raw_body: bytes, timestamp: str, signature: str) -> bool:
    """raw_body: the request body exactly as received, before JSON parsing."""
    if not timestamp or not timestamp.isdigit():
        return False
    if abs(time.time() - int(timestamp)) > 300:
        return False
    signed = timestamp.encode() + b"." + raw_body
    expected = "sha256=" + hmac.new(SECRET, signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature or "")


# Flask example:
# ok = verify(request.get_data(),
#             request.headers.get("X-Mastak-Timestamp", ""),
#             request.headers.get("X-Mastak-Signature", ""))

Instagram rules

Mastak works through Instagram's official messaging API and keeps to the limits Instagram sets for every app that uses it.

• One private reply per comment. A comment can get one private reply, sent within 7 days of the comment.
• 24 hours to answer in Direct. After a buyer's last message you have 24 hours to reply. The dashboard shows how much of the window is left.
• The buyer writes first. A business can message someone only after that person comments or writes to it.

Instagram is a trademark of Meta. Mastak is not affiliated with or endorsed by Meta.