Secure Webhook Endpoint with API Key Validation - n8n Workflow

This n8n template is ideal for:

API Developers needing to secure internal automation endpoints.
System Administrators who want a robust authentication layer before processing sensitive webhook data.
Anyone learning how to implement security logic within a complex n8n workflow.
Users looking for advanced n8n node configuration examples, particularly with the Webhook n8n trigger.

Securing public-facing endpoints is critical for any production automation system. This specific n8n workflow demonstrates a best-practice pattern for validating API keys (acting as authentication tokens) embedded in the request headers before processing the payload.

Instead of relying on basic n8n authentication methods, this approach simulates connecting to a database (using a mock list in a Set n8n node) to check if the supplied x-api-key is registered and valid. If the key is not found, the n8n workflow immediately rejects the request with a 401 Unauthorized status. This sophisticated use of n8n templates ensures only authorized systems can interact with your crucial backend automation.

This n8n workflow operates using two integrated API flows:

1. The Public Trigger: The execution starts with the Secured Webhook n8n trigger, awaiting a POST request containing the x-api-key header.


2. Key Lookup Request: The Check API Key n8n node immediately takes the header value and uses an HTTP Request to call an internal, private webhook endpoint.


3. Mock Database Validation: This internal endpoint (Get API Key n8n trigger) accesses a list of valid keys stored in the Registered API Keys Set n8n node. The data is split out by the Split Out Users n8n node.


4. Filtering: The Find API Key n8n node searches the list for a match against the key provided in the request body.


5. Authorization Gate: Back in the main flow, the API Key Identified If n8n node checks the result of the lookup. If a valid user ID was returned, the flow proceeds down the success path.


6. Response: If valid, the Respond to Webhook (success) n8n node returns a 200 status. If invalid, the flow redirects to the Respond to Webhook (unauthorized) n8n node, returning a 401 Unauthorized error, completing the secure n8n workflow.

To utilize this n8n template, follow these steps:

1. Import: Copy the provided JSON into your n8n instance using the 'New' -> 'Import from JSON' option.


2. Credentials: Both the Secured Webhook and Check API Key n8n nodes require an HTTP Header Auth credential configured (named n8n Templates in the original template). Ensure this credential is set up correctly, although for API key validation, the main security logic relies on the workflow itself.


3. Define Keys: Navigate to the Registered API Keys Set n8n node and edit the JSON array to include the actual API keys and user IDs you wish to authorize.


4. Test: Use the Test Secure Webhook n8n node to execute the n8n workflow manually. Modify the x-api-key header in this node to test both successful (valid key) and failure (invalid key) scenarios.


5. Activate: Set the n8n workflow to 'Active' to start listening for external requests.

The core security logic relies on careful configuration of these n8n nodes:

Secured Webhook (Webhook n8n trigger):
Function: The public entry point for the n8n workflow.
Key Configuration: Method is set to POST. It uses headerAuth for basic security and responseMode: responseNode to allow the flow to determine the final response.
Registered API Keys (Set n8n node):
Function: Acts as a mock database storing valid API keys and associated userid values. This node should be replaced by a database query in production n8n templates.
Key Configuration: Contains a JSON array defining authorized keys.
Check API Key (HTTP Request n8n node):
Function: Sends the received x-api-key to the internal validation endpoint. It is crucial for routing the authentication request.
Key Configuration: URL dynamically constructs the internal webhook path; body parameters include the apikey taken from the main webhook's headers.
API Key Identified (If n8n node):
Function: The central decision gate. Checks if the key lookup process successfully found a corresponding user ID.
Key Configuration: Checks if the $json.user_id is defined, proceeding to success if true, or unauthorized response if false. This determines the subsequent steps of the n8n workflow.