n8n Webhooks Skill

n8n workflows push data to your app with the HTTP Request node. n8n does not sign these requests, so the webhook endpoint authenticates them with a shared secret sent through an n8n credential, and routes them by an event field you put in the body.

When to Use This Skill

• How do I receive webhooks from an n8n workflow?
• How do I secure an endpoint that n8n's HTTP Request node calls?
• How do I verify the X-Webhook-Secret / Bearer token n8n sends?
• Does n8n sign webhook requests? (No: use a shared secret)
• Why does my n8n HTTP Request node get a 401 from my webhook endpoint?

Verification (core)

Configure the HTTP Request node with a generic credential and check it with a constant-time compare:

const crypto = require('crypto');

// Hash both sides: equal-length buffers, so timingSafeEqual never throws.
function safeEqual(a, b) {
  const ha = crypto.createHash('sha256').update(String(a)).digest();
  const hb = crypto.createHash('sha256').update(String(b)).digest();
  return crypto.timingSafeEqual(ha, hb);
}

function verifyN8nRequest(headers, secret, headerName = 'x-webhook-secret') {
  if (!secret) return false;                     // never accept when unconfigured
  const custom = headers[headerName];            // Header auth
  if (custom && safeEqual(custom, secret)) return true;
  const bearer = (headers.authorization || '').match(/^Bearer\s+(.+)$/i);
  return Boolean(bearer && safeEqual(bearer[1].trim(), secret)); // Bearer auth
}

Return 401 when this fails, 400 for a body that isn't a JSON object, and 200 once handled. There is no signature, so the raw body isn't needed for verification, but authenticate before parsing it. Basic auth decoding is in references/verification.md.

For complete handlers with tests (Header, Bearer and Basic auth, event dispatch), see examples/express/, examples/nextjs/, examples/fastapi/.

Event Types

n8n has no built-in webhook event types; the payload is whatever the workflow sends. Send {"event": "...", "id": "...", "data": {...}} and dispatch on event. The examples use:

Environment Variables

N8N_WEBHOOK_SECRET=replace-with-a-long-random-secret   # Header auth Value / Bearer Token
N8N_WEBHOOK_HEADER=X-Webhook-Secret                     # Header auth Name
N8N_BASIC_AUTH_USER=                                    # optional Basic auth
N8N_BASIC_AUTH_PASSWORD=

Local Development

n8n Cloud can't reach localhost. Tunnel with the Hookdeck CLI (no account required):

npx hookdeck-cli listen 3000 n8n --path /webhooks/n8n

Use the printed URL as the HTTP Request node's URL.

Resources

• references/overview.md - How n8n sends requests, suggested payload shape, example events
• references/setup.md - Configure the HTTP Request node, credential and body
• references/verification.md - Header/Bearer/Basic auth checks, gotchas, debugging 401s
• examples/ - Runnable Express, Next.js and FastAPI handlers with tests