Webhook Trigger
The Webhook Trigger fires the workflow when an HTTP request is received at a registered URL. It supports multiple verification strategies to ensure requests come from trusted sources.
Properties
| Property | Required | Description |
|---|---|---|
| Use Verification | No | Enables request verification. Off by default |
| Verification Type | If verification enabled | The method used to verify incoming requests |
| Use Challenge | No | Enables a challenge-response handshake (e.g. for Slack URL verification) |
Webhook URL
The webhook URL is registered when the workflow is published. You can find the registered URL in the Webhook Trigger node's properties when viewing the published workflow.
Verification types
IP Whitelist
Only allows requests from specified IP addresses or CIDR ranges.
| Field | Description |
|---|---|
| Allow List | One IP address or CIDR range per line (e.g. 192.168.1.0/24) |
| Trust X-Forwarded-For | When enabled, the IP is read from the X-Forwarded-For header instead of the connection IP. Enable this when your webhook sits behind a reverse proxy |
HMAC Verification
Validates a cryptographic signature sent with the request.
| Field | Description |
|---|---|
| Algorithm | SHA256, SHA512, or SHA1 |
| Header Name | The request header containing the signature |
| Format | How the signature is encoded: Prefix, Base64, or Hex |
| Prefix | Optional prefix stripped before verifying (e.g. sha256=) |
| Secret Variable | The name of a Secret holding the signing key |
API Key Verification
Checks for a static API key in the request.
| Field | Description |
|---|---|
| Location | Where the key appears: Query String, Header, or Basic Auth |
| Query Param / Header Name | The parameter or header name to check |
| Secret Variable | The name of a Secret holding the expected key value |
JWT Verification
Validates a JWT bearer token in the Authorization header.
| Field | Description |
|---|---|
| Signing Mode | JWKS URI (asymmetric) or Symmetric Secret |
| JWKS URI | URL of the JSON Web Key Set (for asymmetric verification) |
| Validate Issuer | Toggle; if on, checks the iss claim |
| Issuer | Expected issuer value |
| Validate Audience | Toggle; if on, checks the aud claim |
| Audience | Expected audience value |
| Required Claims | Additional claims that must be present |
| Secret Variable | For symmetric mode: the Secret holding the signing key |
Custom Script
A JavaScript function that returns a verification result. Full control over the verification logic.
// Available globals: request, body, env, crypto
const signature = request.headers['x-signature'];
const expected = await crypto.hmac('sha256', env.get('WEBHOOK_SECRET'), body);
return { verified: signature === expected };
The function must return an object with a verified boolean and an optional reason string shown in logs on failure.
Challenge-response
Some webhook providers (e.g. Slack) send a one-time challenge request to verify the URL before sending real events. Enable Use Challenge to handle this automatically.
| Field | Description |
|---|---|
| Challenge Type | Currently supports Plain |
| Challenge Method | HTTP method of the challenge request: GET, POST, or PUT |
| Token Location | Where the challenge token appears: Query String, Header, or Body |
| Parameter Path | The key name or JSON path of the token |
| Challenge Secret | Optional secret used to sign the challenge response |
Trigger output
The webhook trigger passes the full incoming request to downstream nodes. Access the request body and headers in expressions as $TriggerData.