Webhook fundamentals & security
Listen to the web in real time.
Move beyond polling. Learn how webhooks push data to n8n instantly, how to parse header signatures to reject forged requests, and how to respond with fast 200 OK ACKs before heavy processing.
// Code node: verify the signature on the raw request body
// Webhook node: enable "Raw Body"; allow crypto via NODE_FUNCTION_ALLOW_BUILTIN
const crypto = require('crypto');
const raw = await this.helpers.getBinaryDataBuffer(0, 'data');
const expected = 'sha256=' + crypto
.createHmac('sha256', $env.WEBHOOK_SECRET).update(raw).digest('hex');
const received = $input.first().json.headers['x-hub-signature-256'] || '';
if (received.length !== expected.length ||
!crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected))) {
throw new Error('Invalid signature');
}
return $input.all();Configure an n8n Webhook node with test vs production URLs, verify an HMAC header, and test with cURL.

