Secure Webhook with API Key Authentication - Essential

This workflow establishes a robust security pattern for n8n webhooks by requiring a valid API key in the 'x-api-key' header of incoming POST requests. The Secured Webhook node receives the request, extracts the key, and verifies it via an internal HTTP request to a secondary 'Get API Key' webhook. This internal endpoint queries a mock database (Registered API Keys node) to match the provided key against authorized pairs, separating public exposure from data storage for enhanced security.

If the key matches, execution routes to success, returning a 200 OK with the user's ID. Invalid keys trigger a 401 Unauthorized response. Benefits include preventing unauthorized access, easy scalability to real databases, and minimal setup time (~2 minutes). It promotes best practices like using Header Auth credentials for internal comms.

Ideal use cases: Protecting webhooks in production apps, API gateways for third-party integrations, or any n8n automation handling sensitive data. Adapt for e-commerce order webhooks, IoT device callbacks, or CRM lead captures by swapping the mock DB with external services like PostgreSQL or Airtable.