Secure GitHub webhooks with HMAC256 signature validation
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 7 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects GitHub.
How it runs
Trigger: When an HTTP POST request hits its webhook URL.
- Compute HMAC (Crypto): hashes or encrypts values
- Validate HMAC (If): checks a condition and branches into true / false
- Respond 200 OK (Respond to Webhook): sends the response back to the webhook caller
- Respond 401 Unauthorized (Respond to Webhook): sends the response back to the webhook caller
- Get the profile of a repository (GitHub): get profile (repository)
- Stop and Error: stops the run with an error
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (6)
- Respond to Webhook
n8n-nodes-base.respondToWebhook - Webhook
n8n-nodes-base.webhook - Crypto
n8n-nodes-base.crypto - If
n8n-nodes-base.if - GitHub
n8n-nodes-base.github - Stop and Error
n8n-nodes-base.stopAndError
From the author
Use cases Ensure that the calls to the workflow's webhook are (a) originating from the correct GitHub repository and (b) haven't been tampered with. How it works When a secret is provided in a GitHub webhook configuration, a x-hub-signature-256 header is…