Secure GitHub Webhook Validation using HMAC256 - n8n Workflow

DevOps and Security Engineers: Professionals needing to ensure the authenticity of incoming automated events.
n8n Power Users: Anyone building public-facing webhooks that require robust security checks.
Developers: Users integrating GitHub processes and seeking reliable, secure n8n templates for deployment.
Automation Specialists: Those who need advanced core logic flow control within their n8n workflows.

The integrity and authenticity of webhook requests are paramount for secure automation. Without signature validation, your n8n workflow could be vulnerable to unauthorized or malicious requests. This essential n8n workflow provides a robust security layer by implementing HMAC-SHA256 validation, exactly as GitHub recommends. The core value of this n8n template is its ability to replicate the signature calculation performed by GitHub, using a shared secret. This setup ensures that your downstream n8n nodes only execute upon receiving verified, untampered data originating from your configured GitHub repository. This methodology makes this one of the most secure and reliable n8n templates for integrating with source control platforms.

The secure process begins with the GitHub Webhook n8n trigger, which listens for incoming POST requests. Once a request is received, the workflow immediately routes the payload to the Compute HMAC256 n8n node. This node calculates the HMAC-SHA256 signature of the raw JSON body using the secret key defined during GitHub webhook setup. The subsequent Validate HMAC256 If n8n node then executes a critical security check: it compares the newly computed signature with the value provided in the incoming x-hub-signature-256 header (after extracting the hash).

If the validation is successful (signatures match), the workflow confirms the request's authenticity by sending a 200 OK response via the Respond to Webhook n8n node, allowing the rest of the n8n workflow to proceed (e.g., executing the placeholder GitHub n8n node).

If validation fails, the workflow immediately sends a 401 Unauthorized response via a separate Respond to Webhook n8n node, signalling the failure to GitHub. Subsequently, a Stop and Error n8n node halts the execution and logs the security failure, ensuring that no unauthorized code runs within this n8n workflow.

1. Import the n8n workflow: Copy the provided JSON and import it directly into your n8n instance.


2. Setup Webhook: Note the path provided by the GitHub Webhook n8n trigger (e.g., /github-test). Use this full URL in your GitHub repository's webhook settings.


3. Set the Secret: Crucially, update the Secret parameter in the Compute HMAC256 n8n node. This value must be identical to the secret key you configured in your GitHub webhook settings.


4. Configure Credentials: Ensure the placeholder Get the profile of a repository GitHub n8n node has valid GitHub API credentials configured if you plan to use this part of the n8n template for further automation.


5. Activate: Set the n8n workflow to active. The security check is now live for all incoming webhook calls.

GitHub Webhook (n8n trigger): The entry point of this secure n8n workflow. It listens for incoming GitHub POST requests on a specific path, configured to wait for a subsequent response node.
Compute HMAC256 (Crypto n8n node): Essential security component. It uses the SHA256 hashing type and the HMAC action to calculate the signature based on JSON.stringify($json.body). The result is stored in signature-256.
Validate HMAC256 (If n8n node): Performs the critical comparison. It checks if the computed value ($json['signature-256']) equals the value extracted from the x-hub-signature-256 header. This logic controls the flow of the entire n8n workflow.
Respond 200 OK & Respond 401 Unauthorized (Respond to Webhook n8n node): These nodes handle communication back to GitHub, confirming success (200) or denial (401) of the validation process.
Stop and Error (n8n node): Used on the unauthorized path (401) to explicitly log the failure and prevent the n8n workflow execution from continuing, which is excellent for monitoring security issues.
Get the profile of a repository (GitHub n8n node): A placeholder for all subsequent, authorized business logic once the webhook is verified. Replace this n8n node with your required automation steps.