Auth Webhook icon

Auth Webhook

Webhook trigger with built-in Auth Service token validation — replaces Webhook + Auth Service + IF

Auth Webhook

AI-generated

Summary

Starts a workflow from an incoming HTTP webhook only if the request carries a token that the Auth Service validates for a chosen zone and permission level. Requests with a missing or invalid token get a 403 and the workflow doesn't run.

Inputs

  • HTTP Method — Method to listen for: DELETE, GET, HEAD, PATCH, POST (default) or PUT.
  • Path (required) — Webhook path, used as the full path after /webhook/.
  • Auth Zone (required) — Zone to validate the token against. The list is loaded from the Auth Service /tokens/zones endpoint using the credentials.
  • Auth Level (required) — Minimum permission required: read (default), write, delete or all.
  • Token Source — Read the token from the Authorization header (default) or from a custom header.
  • Header Name (required) — Name of the custom header that holds the token. Shown only when Token Source is Custom Header. Default is X-Auth-Token.
  • Token Prefix — Prefix to strip from the header value, default 'Bearer'. Matching is case-insensitive and expects a following space. Leave empty if the header holds the raw token.
  • Respond — When to respond: Immediately, When Last Node Finishes, or via a 'Respond to Auth Webhook' node.
  • Response Code — HTTP status code to return on success, 100–599, default 200.
  • Options — Optional settings: Response Headers, Binary Data, and, in Immediately mode only, Response Data and No Response Body.

Output shape

One item per accepted request. The json field holds headers, params, query and body. Uploaded files appear as binary properties.

The auth header, or the custom token header, is removed from headers so the token isn't exposed. A missing or invalid token gets a 403 JSON error (No authentication token provided or Token validation failed) and the workflow doesn't run. A failed or unreachable validation call is treated as invalid. Multipart form fields are moved from body.data to the body root. Uploaded files are read from disk into binary data, named by form field. If a field has several files, names get an _index suffix. Binary output is always on in the code, so the Binary Data option has no effect. The code doesn't read the Response Code, Response Headers, Response Data or No Response Body settings in the webhook() function, so those may not take effect.

Examples

Example 1: Protect a POST endpoint so only callers with write access to the 'orders' zone can trigger the workflow.

HTTP Method=POST, Path=orders, Auth Zone=orders, Auth Level=write, Token Source=Authorization Header, Token Prefix=Bearer.

Example 2: Accept tokens from an X-Auth-Token header on a GET endpoint with read access.

HTTP Method=GET, Path=reports, Auth Zone=reports, Auth Level=read, Token Source=Custom Header, Header Name=X-Auth-Token, Token Prefix empty.

Links

Discussion