# n8n Webhooks

n8n workflows push data to your app with the **HTTP Request** node. n8n does not sign these
requests, so the webhook endpoint authenticates them with a shared secret sent through an n8n
credential, and routes them by an `event` field you put in the body.

## When to Use This Skill

* How do I receive webhooks from an n8n workflow?
* How do I secure an endpoint that n8n's HTTP Request node calls?
* How do I verify the X-Webhook-Secret / Bearer token n8n sends?
* Does n8n sign webhook requests? (No: use a shared secret)
* Why does my n8n HTTP Request node get a 401 from my webhook endpoint?

## Verification (core)

Configure the HTTP Request node with a generic credential and check it with a constant-time
compare:

| n8n credential | Header received |
| --- | --- |
| Header Auth (Name `X-Webhook-Secret`) | `X-Webhook-Secret: <secret>` |
| Bearer Auth | `Authorization: Bearer <secret>` |
| Basic Auth | `Authorization: Basic base64(user:password)` |

```javascript
const crypto = require('crypto');

// Hash both sides: equal-length buffers, so timingSafeEqual never throws.
function safeEqual(a, b) {
  const ha = crypto.createHash('sha256').update(String(a)).digest();
  const hb = crypto.createHash('sha256').update(String(b)).digest();
  return crypto.timingSafeEqual(ha, hb);
}

function verifyN8nRequest(headers, secret, headerName = 'x-webhook-secret') {
  if (!secret) return false;                     // never accept when unconfigured
  const custom = headers[headerName];            // Header auth
  if (custom && safeEqual(custom, secret)) return true;
  const bearer = (headers.authorization || '').match(/^Bearer\s+(.+)$/i);
  return Boolean(bearer && safeEqual(bearer[1].trim(), secret)); // Bearer auth
}

```

Return `401` when this fails, `400` for a body that isn't a JSON object, and `200` once
handled. There is no signature, so the raw body isn't needed for verification, but
authenticate before parsing it. Basic auth decoding is in
[references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/n8n-webhooks/references/verification.md).

> **For complete handlers with tests** (Header, Bearer and Basic auth, event dispatch), see
> [examples/express/](https://github.com/hookdeck/webhook-skills/tree/main/skills/n8n-webhooks/examples/express/), [examples/nextjs/](https://github.com/hookdeck/webhook-skills/tree/main/skills/n8n-webhooks/examples/nextjs/),
> [examples/fastapi/](https://github.com/hookdeck/webhook-skills/tree/main/skills/n8n-webhooks/examples/fastapi/).

## Event Types

n8n has no built-in webhook event types; the payload is whatever the workflow sends. Send
`{"event": "...", "id": "...", "data": {...}}` and dispatch on `event`. The examples use:

| Event | Sent When |
| --- | --- |
| `lead.created` | A workflow captures a new lead |
| `order.created` | A workflow sees a new order |
| `workflow.completed` | A long-running workflow finishes |
| `workflow.failed` | An Error Trigger workflow catches a failure |

## Environment Variables

```bash
N8N_WEBHOOK_SECRET=replace-with-a-long-random-secret   # Header auth Value / Bearer Token
N8N_WEBHOOK_HEADER=X-Webhook-Secret                     # Header auth Name
N8N_BASIC_AUTH_USER=                                    # optional Basic auth
N8N_BASIC_AUTH_PASSWORD=

```

## Local Development

n8n Cloud can't reach `localhost`. Tunnel with the Hookdeck CLI (no account required):

```bash
npx hookdeck-cli listen 3000 n8n --path /webhooks/n8n

```

Use the printed URL as the HTTP Request node's **URL**.

## Resources

* [references/overview.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/n8n-webhooks/references/overview.md) - How n8n sends requests, suggested payload shape, example events
* [references/setup.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/n8n-webhooks/references/setup.md) - Configure the HTTP Request node, credential and body
* [references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/n8n-webhooks/references/verification.md) - Header/Bearer/Basic auth checks, gotchas, debugging 401s
* [examples/](https://github.com/hookdeck/webhook-skills/tree/main/skills/n8n-webhooks/examples/) - Runnable Express, Next.js and FastAPI handlers with tests