Pachca Signature Verify — beta (Pachca API Credentials)

n8n Community Node n8n-nodes-pachca-signature-verify · 0.1.0-beta.1 · Unofficial (not affiliated with Pachca or n8n).

This release reuses your existing Pachca API credentials (pachcaApi) from the separately installed n8n-nodes-pachca community package. It reads only the signingSecret field to verify incoming webhooks locally; no requests to the Pachca API are made by the verifier.

This is an unverified beta; it is published to npm for manual installation on your own self-hosted n8n. An n8n Verified status is not required for npm publication, but official n8n community-node lint/verification rules can flag reuse of credentials from another package.

Usage

Webhook (Raw Body ON) → Pachca Signature Verify → Valid / Invalid

1. Install n8n-nodes-pachca on the same n8n instance (and all relevant workers). Create or reuse a Pachca API credential with a correct Webhook Signing Secret. The API access token is not required for this verification node, although the external credential form may ask for it.
2. Add the normal n8n Webhook (POST), switch Raw Body ON in Options.
3. Connect it to Pachca Signature Verify and choose the existing Pachca API credential corresponding to this bot.
4. The node verifies the lowercase or mixed-case Pachca-Signature HTTP header against the exact original request bytes in binary.data. A raw string json.body also works. It does not reserialize parsed JSON.
5. Keep Verify Timestamp ON for real-time webhooks (default window: 300 seconds). Disable it only for archived-event tests.
6. The two standard main outputs are Valid and Invalid. The node preserves input JSON/binary and adds pachcaVerification: {valid, reason}. Invalid signatures are routed to Invalid; missing Signing Secret configuration throws an error.
7. To return HTTP 200 or 401 to the webhook sender, connect each branch to a separate Respond to Webhook node. The verifier itself does not set HTTP status codes or create a new webhook URL.

Offline-only security behavior

• HMAC-SHA256 using node:crypto with timing-safe comparison; no fetch, HTTP client, telemetry, or Pachca API calls in the verification implementation.
• A correctly signed but old event produces EXPIRED_TIMESTAMP when timestamp validation is enabled.
• A wrong bot credential, modified raw body, or invalid signature produces INVALID_SIGNATURE or MISSING_OR_INVALID_SIGNATURE.
• A signed event can be replayed within the accepted timestamp window. For replay-sensitive workflows, deduplicate event/message IDs after signature verification in persistent storage.
• Do not use JSON.stringify(item.json.body) in production to reconstruct the body. HMAC covers exact bytes. A mocked/reconstructed event is useful for testing only when its bytes are identical to the signed request.
• This node's access to a full external Pachca API credential implies that other fields, including accessToken, are technically accessible to its code. The included implementation reads only signingSecret and makes no network calls. Review code before installing.
• One node has one chosen credential. For multiple bots, use an explicit routing strategy and verify against each correct bot's credential; do not treat unverified payload fields as trusted identities.

Compatibility and installation

Requires the separately installed n8n-nodes-pachca package exposing credential type pachcaApi with signingSecret. Tested in the developer's local environment with the official Pachca integration. If its credential schema is changed in the future, this verifier may need an update.

Install in self-hosted n8n by specifying the exact beta version:

n8n-nodes-pachca-signature-verify@0.1.0-beta.1

Do not simultaneously register both a locally copied custom node and the npm-installed node with the same type. Use a clean laboratory instance to test the published npm package.

For Docker queue-mode setups, the package must load in both main and worker; persist ~/.n8n/nodes or bake the pinned version into the image, and make a rollback plan before restarting services. Already installed packages are not automatically guaranteed to work with every future n8n version or blocklist policy.

Build

This ZIP is a source overlay for the existing node-cli project (npm create @n8n/node@latest). It does not include the project's node_modules or its full generated package.json. Use the included apply-to-existing-project.sh to replace the temporary public-beta implementation, while making a backup of the previous project files.

bash /path/to/pachca-signature-verify-pachcaapi-beta/apply-to-existing-project.sh \
  "$HOME/Downloads/n8n-community-node/n8n-nodes-pachca-signature-verify"
cd ~/Downloads/n8n-community-node/n8n-nodes-pachca-signature-verify
npm run build
npm test
npm pack --dry-run

Publication and rollback instructions in PUBLISHING-RU.md.

License

MIT, see LICENSE.