Package Information
Available Nodes
Documentation generating…
Documentation
n8n-nodes-verify-webhook
An n8n node that checks the signature of an incoming webhook. Requests with a good signature leave through the
Valid output, everything else through Invalid, so a workflow never acts on a forged call.
Supported: GitHub, Stripe, Shopify, Slack, Zoom, and a generic HMAC (SHA-1, SHA-256, SHA-512, hex or base64, optional
prefix) for anything else.
Install
In n8n: Settings, Community Nodes, install n8n-nodes-verify-webhook.
Use
- In the Webhook node, add the option Raw Body. The signature is computed over the exact bytes the sender
posted, and a JSON body that n8n has parsed and written out again usually differs from them. - Connect a Verify Webhook node, pick the provider and paste the signing secret.
- Use the Valid output for your workflow. The Invalid output carries the reason in
verification.reason.
The node reads the signature (and, for Slack and Zoom, the timestamp) from the headers of the incoming item. The header
names are filled in for each provider and can be changed.
| Provider | Header | What is signed |
|---|---|---|
| GitHub | X-Hub-Signature-256 |
body, sha256=<hex> |
| Shopify | X-Shopify-Hmac-Sha256 |
body, base64 |
| Stripe | Stripe-Signature |
<t>.<body>, checks t against the tolerance |
| Slack | X-Slack-Signature |
v0:<timestamp>:<body>, checks the timestamp |
| Zoom | X-Zm-Signature |
v0:<timestamp>:<body>, checks the timestamp |
| Generic | your choice | body |
Comparison is constant time. For Stripe, Slack and Zoom a timestamp more than 300 seconds (adjustable) from now is
rejected, which stops replayed requests. Set the tolerance to 0 to turn that off.
If you prefer an error over a second output, set On Invalid to Stop With an Error.
Development
npm install
npm test
npm run build
License
MIT