DEV Community

Altiora
Altiora

Posted on

n8n Webhook Guide: Accept Data from Any App (2026 Tutorial)

#n8n #webhook #api #tutorial

Webhooks are the backbone of automation. They let any app push data into your n8n workflows in real-time — no polling, no delays.

This guide covers everything you need to know about n8n webhooks in 2026.

What is a Webhook?

A webhook is an HTTP endpoint that receives data when an event occurs. Instead of your workflow checking "is there new data?" every few minutes (polling), the data comes to you instantly.

Common webhook sources:

  • Stripe (new payment)
  • GitHub (new commit/PR)
  • Typeform (new submission)
  • Shopify (new order)
  • Custom apps (any HTTP POST)

Setting Up Your First n8n Webhook

Step 1: Add a Webhook Node

In your n8n workflow, add a Webhook node as the first trigger.

You'll get two URLs:

  • Test URL — Works only when you click "Listen for Test Event"
  • Production URL — Works when the workflow is activated

Step 2: Configure the Method

Choose the HTTP method:

  • POST (most common) — Receives data in the request body
  • GET — Receives data in query parameters

For most integrations, use POST with JSON body.

Step 3: Respond to the Sender

Configure the response:

  • Immediately — Returns 200 OK right away (best for most cases)
  • Using 'Respond to Webhook' Node — Returns custom data after processing

Important: Many services (Stripe, GitHub) expect a response within 5 seconds. Use "Immediately" mode to avoid timeouts.

Advanced Webhook Patterns

Authentication

Protect your webhook with:

Header Auth:

Authentication: Header Auth
Header Name: X-API-Key
Header Value: your-secret-key
Enter fullscreen mode Exit fullscreen mode

Basic Auth:

Authentication: Basic Auth
Username: webhook_user
Password: secure_password
Enter fullscreen mode Exit fullscreen mode

Request Validation

Verify webhook signatures (critical for production):

// In a Code node after the webhook
const crypto = require('crypto');
const signature = $input.first().headers['x-signature'];
const payload = JSON.stringify($input.first().json);
const expected = crypto.createHmac('sha256', 'your_secret')
  .update(payload).digest('hex');

if (signature !== expected) {
  throw new Error('Invalid webhook signature');
}
return $input.all();
Enter fullscreen mode Exit fullscreen mode

Deduplication

Prevent processing the same event twice:

  1. Extract a unique ID from the webhook payload
  2. Check against a database/spreadsheet of processed IDs
  3. Skip if already processed 
// Check if we've seen this event
const eventId = $json.event_id;
// Query your DB: SELECT 1 FROM processed_events WHERE event_id = ?
// If found, skip. If not, process and insert.
Enter fullscreen mode Exit fullscreen mode

Real-World Examples

Stripe Payment → Notification + CRM 

Stripe Webhook → Verify Signature → Switch (event type)
  ├── payment_success → Create CRM Contact → Send Welcome Email → Slack Alert
  ├── payment_failed → Send Retry Email → Alert Support Team
  └── subscription_cancelled → Update CRM → Trigger Win-back Sequence
Enter fullscreen mode Exit fullscreen mode

GitHub PR → Code Review Pipeline 

GitHub Webhook → Filter (action: opened) → Fetch PR Diff
  → AI Code Review (OpenAI) → Post Comment on PR → Slack Notification
Enter fullscreen mode Exit fullscreen mode

Form Submission → Lead Pipeline 

Typeform Webhook → AI Lead Scoring → Route by Score
  ├── Hot → Instant Email + Slack Alert + CRM Priority
  ├── Warm → Nurture Sequence + CRM Standard
  └── Cold → Newsletter List + Log
Enter fullscreen mode Exit fullscreen mode

Debugging Webhooks

Common Issues

  1. Webhook not receiving data — Make sure the workflow is activated (not just in test mode)
  2. Timeout errors — Use "Respond Immediately" mode
  3. Wrong data format — Check Content-Type header (should be application/json)
  4. Duplicate events — Implement deduplication logic

Testing Tools

  • n8n Test Mode — Click "Listen for Test Event" and send a test request
  • curl — Quick command-line test: 
curl -X POST https://your-n8n.com/webhook/abc123 \
  -H "Content-Type: application/json" \
  -d '{"name":"test","email":"test@example.com"}'
Enter fullscreen mode Exit fullscreen mode

Production Checklist

  • [ ] Authentication configured (header auth or signature verification)
  • [ ] Error handling workflow connected
  • [ ] Deduplication implemented for critical workflows
  • [ ] Rate limiting considered (n8n handles this at the server level)
  • [ ] Logging enabled for debugging
  • [ ] HTTPS endpoint (never use HTTP in production)

Want Pre-Built Webhook Workflows?

Skip the setup time with production-ready templates:

For more tutorials, visit dev.to/automatewithai.

What webhook integration are you building? Drop a comment — happy to help debug.

Top comments (0)