Secure AI agent webhook with HMAC, replay protection, and OpenAI GPT-5
n8n11 modulesv1.0Disclaimer: > I am not a cybersecurity expert. This workflow was built through research and with the assistance of an LLM (Claude Opus 4.6). While it implements well-established security patterns (HMAC-SHA256, timing-safe comparison, replay protection, strict payload validation), please review the logic carefully and ensure it meets your own security requirements before deploying it in production. Who is this for? This template is for anyone exposing an n8n workflow via webhook and wanting
At a glance
Secure AI agent webhook with HMAC, replay protection, and OpenAI GPT-5 is a ready-made n8n workflow you import as a workflow JSON file — no build required. It connects OpenAI. It's free to download. Follow the 5-step import below to go live in minutes.
- Platform
- n8n
- Connects
- OpenAI
- Modules
- 11
- Price
- Free
- Version
- v1.0
About this workflow
Disclaimer: > I am not a cybersecurity expert. This workflow was built through research and with the assistance of an LLM (Claude Opus 4.6). While it implements well-established security patterns (HMAC-SHA256, timing-safe comparison, replay protection, strict payload validation), please review the logic carefully and ensure it meets your own security requirements before deploying it in production. Who is this for? This template is for anyone exposing an n8n workflow via webhook and wanting to ensure that only authenticated, untampered requests are processed. What problem does this solve? Public webhooks are vulnerable by default. Without proper verification, anyone who discovers your URL can send forged requests, replay old ones, or inject unexpected parameters. While n8n's built-in Webhook authentication modes (Basic Auth, Header Auth, JWT) verify who is calling, they don't verify that the payload hasn't been altered, that the request is fresh, or that the data structure matches what you expect. This template adds those missing layers: - Authentication — Verifies the sender's identity through HMAC-SHA256 signature validation - Integrity — Ensures the payload hasn't been modified by signing the raw body byte-for-byte - Replay protection — Rejects requests with expired timestamps (configurable, default: 5 minutes) - Payload sanitization — Strict whitelist filtering blocks unauthorized fields before they reach your logic What this workflow does The workflow chains six security layers before any business logic runs: 1. Webhook receives the request with Header Auth + Raw Body enabled to preserve the original payload 2. Extract rawBody (Code node) decodes the binary into a UTF-8 string and extracts the security headers 3. Crypto computes the HMAC-SHA256 signature of {timestamp}.{rawBody} using your HMAC secret 4. Timing-Safe HMAC Check (Code node) validates the timestamp freshness and compares signatures using crypto.timingSafeEqual() 5. Strict Payload Validation (Code node) parses the JSON, checks required fields, and rejects any unexpected keys 6. AI Agent processes the prompt only after all checks pass Invalid requests are immediately rejected with 403 Forbidden (signature/timestamp failure) or 400 Bad Request (payload validation failure), with no response body to avoid leaking internal logic. Example use case The included example protects an AI Agent endpoint that expects a simple {"prompt": "..."} payload. But this is just a starting point — replace the AI Agent with any node and adapt the payload validation to your own schema. Common adaptations: CRM or SaaS event callbacks CRUD operations on a database Third-party API integrations Setup Prerequisites - An n8n instance (Cloud or Self-hosted) - A shared HMAC secret between the sender and this workflow — keep it safe and never expose it in workflow logs or execution data Going further This workflow is a solid starting point — it's more secure than a raw exposed webhook. However, it focuses on application-level security (authentication, integrity, replay protection, payload sanitization). For a production-grade setup, consider adding layers at the infrastructure level : - Rate limiting - IP whitelisting - Reverse proxy hardening
How to import this n8n workflow
- 1
Download the workflow JSON file after purchase.
- 2
Open n8n → click the menu → Import from File.
- 3
Select the downloaded JSON and import.
- 4
Set up credentials for each node that requires them.
- 5
Click Execute Workflow to test, then activate.
Setup guide
Setup guide included
Purchase to unlock the full step-by-step guide
Related N8n workflows
Digest new YouTube videos to Slack with Google Sheets, RapidAPI & GPT-4o-mini
Extract trends, auto-generate social content with AI, Reddit, Google & post
Generate student course schedules based on prerequisites with GPT and Google Sheets
Create a Telegram bot with Mistral Nemotron AI and conversation memory
Automated meeting recording & AI summaries with Google Calendar, Vexa & Llama 3.2
Monitor Facebook posts and send email notifications with ChatGPT integration
Automate ASMR glass fruit video creation & publishing with Veo, Shotstack & Postiz
Sync Linear issues to Todoist tasks automatically (create, update, close)
Reviews
No reviews yet
Be the first to buy and share your experience.
Leave a review
Sign in to share your experience with this workflow.
Create a free account to purchase workflows.
- JSON blueprint — instant download
- Setup guide PDF included
- 5 downloads · valid 30 days
- Works with n8n
Need help setting this up?
Book a 3-hour live setup session with an Agility consultant.
- Configure live on Google Meet / Zoom
- Free follow-up if workflow has defects
- Platform expert assigned to you