Slack Webhook Signature Verification Handler - n8n Workflow

Developers and Integrators: Anyone setting up custom Slack applications that rely on real-time event subscriptions.
Security-Conscious Users: Organizations requiring confirmation that incoming webhook data genuinely originates from Slack.
n8n Automation Specialists: Users looking for a robust, reusable n8n templates for handling external API security protocols.
System Administrators: Those deploying complex integrations where the integrity of the data source is paramount.

When integrating services using webhooks, security is critical. Unverified webhooks are susceptible to spoofing and unauthorized data injection. Slack provides a robust mechanism—signature verification—to ensure the authenticity of every incoming request.

This specific n8n workflow solves the problem of manual signature checking. By using a series of n8n node steps (Code, Crypto, and IF), it automatically calculates the expected signature based on the timestamp and request body, and then compares it against the signature provided in the x-slack-signature header. If the signatures do not match, the n8n automation immediately halts execution via the Stop and Error n8n node, protecting your downstream systems from processing fraudulent data. This foundational security logic is essential for any production-ready Slack n8n integration.

This reusable n8n workflow is designed to be executed immediately after the primary n8n trigger (like an HTTP Request n8n node) that receives the raw Slack payload.

1. Input Reception (Execute Workflow Trigger): The workflow starts, receiving the raw headers and body of the Slack webhook request.


2. Token Generation (Make Slack Verif Token): A custom JavaScript n8n node uses the request timestamp, headers, and body to meticulously construct the sigBaseString following Slack’s specific encoding rules (handling characters like +, *, and ~). It also isolates the x-slack-signature value.


3. Signature Encoding (Encode Secret String): The Crypto n8n node performs an HMAC-SHA256 hash using the generated sigBaseString and the user's Slack Signing Secret (which must be configured in this n8n node). This result is the candidateSignature.


4. Verification (IF n8n node): The IF n8n node compares the requestSignature from the Slack headers with the calculated signature (v0= followed by the candidateSignature).


5. Success Path: If the signatures match (True branch), a Set n8n node adds the field signature_verified: true. The data is then passed through a Merge n8n node and returned.


6. Failure Path: If the signatures do not match (False branch), the Stop and Error n8n node terminates the n8n workflow execution, returning a security error.

To deploy and utilize this critical n8n templates, follow these steps:

1. Import: Copy the provided n8n workflow JSON and paste it into your n8n instance via the 'New' menu and selecting 'Import from JSON'.


2. Preceding n8n Trigger: Ensure this n8n workflow is linked immediately after an n8n node that handles the raw webhook request (e.g., the webhook n8n trigger itself).


3. Configure Credentials: The most critical setup step is configuring the 'Encode Secret String' n8n node.

1. Execution: When the n8n workflow runs, it will automatically execute the verification logic. The output will either be the verified payload or an error.

Execute Workflow Trigger:
Function: Serves as the input point, receiving the headers and body of the raw webhook request from the calling n8n workflow or n8n trigger.
Key Configuration: No specific parameters; it simply accepts the upstream data structure.
Make Slack Verif Token (Code n8n node):
Function: Custom JavaScript logic to build the exact sigBaseString required by Slack for verification (v0:timestamp:body), including special URL encoding rules. It also extracts the received signature.
Key Configuration: Contains custom JS logic crucial for parsing and formatting the request data correctly.
Encode Secret String (Crypto n8n node):
Function: Calculates the HMAC-SHA256 hash of the sigBaseString using the user's secret key to produce the expected candidateSignature.
Key Configuration: Type: SHA256, Action: HMAC. The Key parameter MUST be set to the Slack Signing Secret.
IF n8n node:
Function: Performs the critical security check, comparing the calculated signature (v0= + candidate) against the received signature from the Slack headers.
Key Configuration: Condition checks if requestSignature equals v0={{ $json.candidateSignature }}.
Set Verified to True (Set n8n node):
Function: If the signature is verified, this n8n node annotates the data with a signatureverified: true boolean.
Key Configuration: Sets a new field named signatureverified to true.
Stop and Error (Stop and Error n8n node):
Function: Used for the failure path. It gracefully terminates the n8n workflow execution if verification fails, raising a descriptive error message to prevent unverified data processing.
Key Configuration: errorMessage: "Could not verify Slack Webhook signature".