WhatsApp Flows End-to-End Encrypted Data Handler - n8n Workflow

• Developers building secure chatbot applications using WhatsApp Flows.
• Businesses required to handle sensitive customer data with E2EE.
• n8n Automation Specialists needing advanced cryptographic logic in an n8n node environment.
• Users looking for robust n8n templates for custom messaging integrations.

This advanced n8n workflow provides a crucial backend solution for businesses utilizing WhatsApp Flows, ensuring full compliance with privacy standards by managing End-to-End Encryption (E2EE). When a user interacts with a flow element on WhatsApp, the data is sent to the backend encrypted. This n8n template automatically processes the incoming webhook, uses a custom code n8n node to decrypt the payload (using RSA for the key and AES-GCM for the data), routes the request based on the screen context, retrieves necessary dynamic data (like available appointments or seats), and finally, re-encrypts the response before sending it back.

This sophisticated n8n workflow is designed to maintain the highest level of security throughout the data exchange, making it an essential tool for secure customer interactions within the n8n automation ecosystem. The custom n8n node implementation is key to handling the complex cryptography required by Meta/WhatsApp.

This n8n workflow operates as a secure bridge between WhatsApp Flows and your backend logic:

1. Trigger and Conversion: The process begins with the Webhook1 n8n trigger, which captures the encrypted POST request from WhatsApp Flows. The move to base64 n8n node immediately converts the essential encrypted components (encryptedflowdata, encryptedaeskey, initialvector) from the request body into binary buffers, preparing them for cryptographic operations.


2. Decryption: The Decryption Code n8n node, executing custom JavaScript, performs the E2EE reversal. It uses a private RSA key (which must be configured inside the node) to decrypt the symmetric AES key, and subsequently utilizes AES-128-GCM to decrypt the actual user payload data securely. The resulting decrypted JSON is then passed to the next n8n node.


3. Parsing and Routing: The Json Parser n8n node extracts critical flow context, such as the screen ID and the required flowtoken. The Switch n8n node then uses the screen ID (e.g., 'APPOINTMENT' or 'DATESELECTIONSCREEN') to route the workflow to the appropriate data handling path.


4. Data Handling: Based on the path, a data extraction n8n node (like Data Extraction Code) processes the user's request and structures the dynamic response data (e.g., grouping available appointment slots by date).


5. Re-Encryption: The Encrypt Return n8n node is executed. It takes the newly prepared JSON response message, inverts the Initial Vector (IV) retrieved earlier, and encrypts the entire response using the recovered AES key and AES-128-GCM. This ensures the response payload is securely transmitted back to WhatsApp.


6. Response: The final encrypted payload is returned immediately via the Respond to Webhook n8n node, completing the secure, end-to-end encrypted conversational exchange driven by the n8n workflow.

To deploy this n8n template, follow these steps:

1. Import Workflow: Copy the provided JSON and import it into your n8n instance via the 'Workflows' menu.


2. Setup Webhook: Activate the Webhook1 n8n trigger node and copy the generated webhook URL. This URL must be provided to Meta/WhatsApp as the endpoint for your Flow's data exchange.


3. Configure Credentials (RSA Key): The most critical step is configuring the Decryption Code n8n node. You must replace the placeholder [INSERT YOUR KEY HERE] within the privateKey variable in the JavaScript code with your actual RSA Private Key, which corresponds to the public key you provided to Meta/WhatsApp for establishing the E2EE channel.


4. Test: Run the n8n workflow in 'Test' mode and interact with your WhatsApp Flow to ensure the decryption and routing logic works correctly for all screens defined in the Switch n8n node.

• Webhook1 (n8n trigger): This is the starting point, listening for incoming POST requests from WhatsApp Flows containing the encrypted data components (encryptedflowdata, encryptedaeskey, initialvector).


• move to base64 (Code n8n node): Converts the Base64-encoded strings from the incoming payload into binary Buffer objects, which is a required format for the Node.js crypto library used in the subsequent n8n node for decryption.


• Decryption Code (Code n8n node): The core cryptographic n8n node. It utilizes the stored RSA private key to decrypt the AES key, then uses AES-128-GCM with the decrypted AES key and Initial Vector (IV) to extract the plain JSON payload from the user interaction.


• Json Parser (Code n8n node): Parses the successfully decrypted JSON payload, extracting high-level session data like the current screen and the flowtoken for conditional routing in this n8n workflow.


• Switch (n8n node): Acts as a flow control mechanism. It routes the execution path based on the extracted screen value, directing appointment-related requests to one path and other requests (like seat selection) to another.


• Data Extraction Code / Data Extraction Code1 (Code n8n nodes): These nodes contain custom logic to prepare the dynamic response data specific to the requested screen (e.g., grouping time slots).


• Encrypt Return / Encrypt Return1 (Code n8n nodes): These n8n nodes handle the re-encryption of the response. They use the inverted Initial Vector (IV) and the recovered AES key to encrypt the structured response JSON using AES-128-GCM, generating the final Base64 string that the Respond to Webhook n8n node sends back.