Meta Deauthorize

Somebody removed HeyMetra from their Facebook settings. Let the grant go.

Until this existed there was no path at all: deauth_callback_url was empty on the Meta app, and nothing in the code base read a signed_request (ZEISO-481). A customer who revoked the app at Facebook left a live-looking connection here and a credential in the vault, and nobody was told. Our own /data-protection/ page says disconnecting destroys the credential immediately; this is the door that sentence did not cover, and Meta's Platform Terms ask for the data to go when the access does.

UNVERIFIED IS NOT ACKNOWLEDGED. The whole message is the signature, and nothing else in the request says who sent it — so an endpoint that answered 200 to an unsigned body would be an endpoint anybody could use to disconnect a stranger's accounts. A refusal is 401 and stores nothing.

Meta wants 200 for a delivery it signed, including one that matches no connection of ours: "we have nothing for this person" is a completed instruction, not a failure, and an error would put the delivery back in Meta's retry queue forever.