How to Secure Webhooks in n8n

Open your Webhook node and expand the Authentication section. Select 'Basic Auth' from the dropdown. Enter a username and password. When Basic Auth is enabled, every request to the webhook must include an Authorization header with the base64-encoded credentials. Requests without valid credentials receive a 401 Unauthorized response. This is the simplest authentication method and works well for internal integrations.

1# Send a request with Basic Auth using curl
2curl -X POST https://n8n.yourdomain.com/webhook/my-endpoint \
3  -u "myuser:mysecretpassword" \
4  -H "Content-Type: application/json" \
5  -d '{"event": "order_created", "order_id": 123}'

In the Webhook node's Authentication section, select 'Header Auth'. Set the Header Name (for example, X-API-Key) and the Header Value (your secret key). n8n checks every incoming request for this header and value. This method is common for service-to-service integrations where the calling service can include custom headers.

1# Send a request with Header Auth
2curl -X POST https://n8n.yourdomain.com/webhook/my-endpoint \
3  -H "X-API-Key: your_secret_api_key_here" \
4  -H "Content-Type: application/json" \
5  -d '{"event": "payment_received", "amount": 49.99}'

Services like GitHub, Stripe, and Shopify sign their webhook payloads with an HMAC-SHA256 signature. The signature is sent in a header (for example, X-Hub-Signature-256 for GitHub). Add a Code node immediately after the Webhook node to verify the signature before processing the payload. If the signature does not match, stop the workflow and return an error.

1const crypto = require('crypto');
2
3// Get the raw body and signature from the webhook
4const rawBody = JSON.stringify($input.first().json.body);
5const signature = $input.first().json.headers['x-hub-signature-256'];
6const secret = 'your_webhook_secret_here';
7
8// Calculate expected signature
9const expectedSignature = 'sha256=' + crypto
10  .createHmac('sha256', secret)
11  .update(rawBody)
12  .digest('hex');
13
14// Compare signatures using timing-safe comparison
15const isValid = crypto.timingSafeEqual(
16  Buffer.from(signature || ''),
17  Buffer.from(expectedSignature)
18);
19
20if (!isValid) {
21  throw new Error('Invalid webhook signature');
22}
23
24return $input.all();

Configure your reverse proxy to only forward requests to the webhook path from known IP addresses. This is especially useful for provider webhooks where the sending service publishes their IP ranges (GitHub, Stripe, etc.). Add an allow list in your Nginx or Caddy configuration for the /webhook/ path.

1# Nginx configuration for IP allowlisting on webhook paths
2location /webhook/ {
3    # GitHub webhook IP ranges (check GitHub docs for current list)
4    allow 140.82.112.0/20;
5    allow 185.199.108.0/22;
6    allow 192.30.252.0/22;
7    deny all;
8
9    proxy_pass http://localhost:5678;
10    proxy_set_header Host $host;
11    proxy_set_header X-Real-IP $remote_addr;
12    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
13    proxy_set_header X-Forwarded-Proto $scheme;
14}

As a baseline security measure, use a long random string as your webhook path instead of a descriptive name. While this is not a replacement for authentication, it makes it much harder for attackers to discover your webhook URL through guessing or scanning. Generate a UUID or random string and use it as the path.

1# Generate a random webhook path
2openssl rand -hex 16
3# Example output: a3f8b2c1d4e5f6a7b8c9d0e1f2a3b4c5
4
5# Use it as the webhook path: /webhook/a3f8b2c1d4e5f6a7b8c9d0e1f2a3b4c5

For maximum security, combine several of these techniques. Use Header Auth on the Webhook node for authentication, add HMAC verification in a Code node for provider webhooks, set up IP allowlisting in your reverse proxy, and use a random webhook path. Each layer blocks a different type of attack, providing defense in depth.