WebhookCatcher for n8n

Catch, inspect, secure and forward webhooks with WebhookCatcher, and react to them in your n8n workflows.

English · Español · Deutsch · Français · Português · 日本語 · Русский · 中文

This package adds four nodes to n8n:

Contents

• Installation
• Credentials
• Token permissions
• WebhookCatcher node
• WebhookCatcher Trigger
• WebhookCatcher Polling Trigger
• WebhookCatcher Event Trigger
• Which trigger should I use?
• Example workflows
• Troubleshooting
• Development
• Resources

Installation

From the n8n editor (recommended)

1. Open Settings → Community Nodes.
2. Click Install.
3. Enter @webhookcatcher/n8n-nodes-webhookcatcher and confirm.
4. Search for WebhookCatcher in the nodes panel.

See the n8n community nodes guide for more details.

Manual installation (self-hosted n8n)

cd ~/.n8n/nodes
npm install @webhookcatcher/n8n-nodes-webhookcatcher

Restart n8n after installing. With Docker, run the command inside the container (in /home/node/.n8n/nodes) and restart the container.

Credentials

The nodes authenticate with a WebhookCatcher API token.

[!NOTE]
API access is available on the Pro, Team and Business plans. Requests made with a token of a team without API access are rejected with 403.

1. Sign in to WebhookCatcher.
2. Open your profile menu → API Tokens.
3. Enter a name (for example n8n) and select the permissions your workflows need.
4. Copy the token. It is shown only once.
5. In n8n, create a WebhookCatcher API credential:

n8n tests the credential by calling GET /account, so the token needs at least the account:read permission.

A token belongs to the team that was active when it was created. Every node that uses the credential works with that team's endpoints and requests.

Token permissions

Give each token only the permissions its workflows need.

Permissions used by each node:

Tokens created before these permissions existed keep working: read allows every :read permission, write allows create, update and delete, and * allows everything.

When a token lacks a permission, the API answers 403 with This API token does not have the "<permission>" permission. and the node shows that message.

WebhookCatcher node

Endpoint

• Create takes a name, a path, the accepted HTTP method and the authentication (None, API Key, Basic Auth, Bearer Token or HMAC) with the auth method that validates it. Additional fields: description, active state and rate limit.
• Update sends only the fields you set. The rest of the endpoint stays as it is.
• Get Many supports Return All or a Limit, and filters by active state.
• Response Status Code, Response Body and Response Headers set what the sender gets back when a webhook is accepted (by default 200 with a JSON body). The body can echo values of the request with {{body.*}}, {{query.*}} and {{header.*}} placeholders, for example {{body.challenge}} for Slack URL verification. Without a Content-Type header, JSON bodies are sent as application/json and anything else as text/plain.

Forwarding Target

Forwards every request that an endpoint accepts to another URL. Options: HTTP method, authentication for the destination, custom headers, automatic retries, active state, description and payload filters (forward only when a field of the payload matches a condition).

The destination must be a public URL. Private, loopback and link-local addresses are rejected to prevent SSRF.

When the target has an auth method, WebhookCatcher authenticates each forwarded request with it: X-API-KEY for API keys, Authorization: Bearer … or Authorization: Basic …, or X-Timestamp and X-Signature for HMAC (hash_hmac('sha256', timestamp + body, secret) over the exact body sent). If the auth method is inactive or expired, the delivery fails instead of being sent without credentials. Set Authentication to None to remove it.

Auth Method

Creates the credentials that endpoints use to validate incoming webhooks: API key, Basic Auth (username and password), Bearer token or HMAC secret. Regenerate Credentials rotates the generated token or secret and returns the new value.

Request

• Get Many filters by endpoint, status (success, error, pending, timeout), HTTP method, response code and date range, sorted newest or oldest first.
• Get Deliveries returns every forwarding attempt of a request with its status code, duration, error and response body.
• Redeliver sends a stored request again to all forwarding targets of its endpoint, to one forwarding target, or to a custom public URL.
• Redeliver Many sends every request that matches the filters (or a list of request IDs) again, oldest first, to the forwarding targets of its endpoint or to one forwarding target. The node continues batch by batch (100 requests per call) until all are queued and returns the redelivered request IDs.
• Delete removes a request with its forwarding attempts. Delete Many removes every request that matches the filters or a list of request IDs. At least one filter is required, so a workflow can never empty the whole log by mistake.
• Every request includes body (parsed) and raw_body: the exact bytes received, for XML, plain text or signed payloads. raw_body is null when it is identical to body encoded as JSON.

Use as an AI Agent tool

The WebhookCatcher node is marked as usableAsTool. Attach it to an n8n AI Agent to let the agent list endpoints, inspect failed requests or redeliver them.

WebhookCatcher Trigger

Starts the workflow as soon as an endpoint accepts a webhook.

1. Add the WebhookCatcher Trigger node and select the endpoint.
2. Activate the workflow, or click Listen for test event.

On activation the node creates a forwarding target on that endpoint. It points to the n8n webhook URL and sends a random X-WebhookCatcher-Secret header. n8n rejects any call without that secret with 401. The forwarding target is deleted when the workflow is deactivated. Test and production URLs get separate forwarding targets.

Output:

{
  "body": { "event": "invoice.paid", "id": "in_123" },
  "query": {},
  "headers": { "content-type": "application/json", "user-agent": "Stripe/1.0" },
  "receivedAt": "2026-10-08T15:04:05.000Z"
}

Turn off Options → Include Headers to output only the body and query.

Turn on Options → Include Raw Body to also output rawBody, the body exactly as it was received. WebhookCatcher forwards the original bytes and Content-Type, so XML, form and plain text webhooks arrive unchanged.

[!IMPORTANT]
WebhookCatcher must be able to reach your n8n instance. Set WEBHOOK_URL in n8n to its public URL. For n8n on localhost, use the Polling Trigger.

WebhookCatcher Event Trigger

Starts the workflow when WebhookCatcher raises an alert. Select the events in Events:

Rate limited and rejected-credential events are sent at most once every 5 minutes per endpoint, so a burst of rejected requests starts one execution.

On activation the node creates an event subscription that points to the n8n webhook URL. WebhookCatcher signs every event with X-WebhookCatcher-Signature (HMAC-SHA256(secret, X-WebhookCatcher-Timestamp + body)). n8n rejects events with an invalid signature or older than 5 minutes with 401. The subscription is deleted when the workflow is deactivated.

Output:

{
  "id": "0199c2a4-5f1e-7c3a-9d1b-2f4e6a8b0c1d",
  "event": "webhook_failed",
  "title": "Webhook Delivery Failed",
  "message": "Delivery to Billing failed: Server Error",
  "team": { "id": 1, "slug": "acme", "name": "Acme" },
  "data": {
    "webhook_request_id": "0199c2a4-...",
    "endpoint_id": "0199c2a0-...",
    "forwarding_target_id": "0199c2a1-...",
    "forwarding_target_name": "Billing",
    "url": "https://billing.example.com/hooks",
    "attempts": 4,
    "response_status": 500,
    "error": "Server Error"
  },
  "occurred_at": "2026-10-09T15:04:05+00:00"
}

data for the other events: endpoint_id, endpoint_name, endpoint_path, status_code, error, method and ip for rate limited and unauthorized requests, action, auth_method_id, auth_type, endpoint_id and user for auth method and endpoint changes, and used, limit, percentage, threshold and month for usage warnings.

The events are the same ones you can receive by email, Slack or Discord. The event trigger does not depend on those alert settings.

[!IMPORTANT]
WebhookCatcher must be able to reach your n8n instance. Set WEBHOOK_URL in n8n to its public URL.

WebhookCatcher Polling Trigger

Checks WebhookCatcher for new requests on the poll interval you choose (every minute, every hour, …).

• Endpoint: one endpoint, or empty for all endpoints.
• Filters → Status: for example only error requests, to get notified about rejected webhooks.

On first activation the node starts from the newest request and does not replay the history. Each poll emits the requests received since the previous poll, oldest first, up to 500 per poll. Any remaining requests are emitted in the next poll.

A manual test run returns the latest request so you can map its fields.

Which trigger should I use?

Example workflows

• Stripe → Slack: WebhookCatcher Trigger on your Stripe endpoint → IF body.type is invoice.payment_failed → Slack message.
• Alert on rejected webhooks: Polling Trigger with Status = Error → email or Slack message with the endpoint, response code and error.
• Retry failed forwards: Schedule Trigger → Request: Get Many (status error, last hour) → Request: Get Deliveries → Request: Redeliver.
• Daily usage report: Schedule Trigger → Account: Get and Get Analytics → Google Sheets.
• Incident on failed deliveries: Event Trigger (Delivery Failed) → PagerDuty or Slack → Request: Redeliver once the destination is back.
• Usage alert: Event Trigger (Monthly Usage Warning) → email the account owner.
• Data retention: Schedule Trigger (daily) → Request: Delete Many (Received Before: 30 days ago).
• Slack app verification: Endpoint: Create with Response Body {{body.challenge}}.
• Customer onboarding: Form Trigger → Auth Method: Create → Endpoint: Create → Forwarding Target: Create → send the URL and credentials to the customer.

Troubleshooting

Development

Requirements: Node.js 20.19 or later and npm.

git clone https://github.com/WebhookCatcher/WebhookCatcher-Node.git
cd WebhookCatcher-Node
npm install
npm run dev

npm run dev builds the nodes, rebuilds them on change and starts a local n8n at http://localhost:5678 with the package loaded.

Releasing

The Publish workflow publishes each release to npm with a provenance statement, which n8n requires for community nodes. Run npm run release locally: it lints, builds, bumps the version, creates the tag and pushes it, and the workflow publishes the package.

Set up npm Trusted Publishing for WebhookCatcher/WebhookCatcher-Node with the publish.yml workflow, or add an NPM_TOKEN repository secret.

Project structure

credentials/
  WebhookCatcherApi.credentials.ts      API token and base URL
nodes/
  WebhookCatcher/                       Action node, shared API helpers and descriptions
  WebhookCatcherTrigger/                Real-time trigger (forwarding target + secret header)
  WebhookCatcherPollingTrigger/         Polling trigger (cursor on request ids)
  WebhookCatcherEventTrigger/           Alert events trigger (signed event subscription)
docs/                                   Translated READMEs and images

Resources

• WebhookCatcher
• n8n community nodes documentation
• Report an issue
• Support: support@webhookcatcher.com

License

MIT