Phase 2: n8n for AI Automation · 50 min · n8n · Webhooks · Nginx

Webhooks and Event-Driven Triggers

React to events in real-time, don't poll for them.

Hiring signal: Webhook configuration is a core automation engineering skill. Being able to set up authenticated webhooks, explain the difference between webhook-triggered and polling workflows, and handle webhook authentication (API keys, HMAC, OAuth) is expected in any automation role.

What you will learn

Configure n8n Webhook nodes to receive HTTP requests as workflow triggers
Implement webhook authentication: API keys, HMAC signatures, OAuth
Choose between webhook-triggered and polling/scheduled workflows
Handle webhook responses: synchronous vs asynchronous processing

The Problem

A company builds an n8n workflow that checks their CRM every 5 minutes for new high-value leads. Each poll makes an API call. Most of the time, there are no new leads — wasted requests, wasted cost. When a lead does arrive, it takes up to 5 minutes to process. The sales team complains that competitors respond faster. Meanwhile, the same company has a Slack integration that polls for new messages every 2 minutes, a payment system that polls Stripe every 10 minutes, and an inventory check that polls the warehouse API every minute. That's 4 polling workflows making thousands of unnecessary API calls per day.

The fix is event-driven architecture: instead of asking "is there anything new?", you let the source tell you "something happened." Webhooks are how systems push events to each other in real-time.

Polling is asking; webhooks are listening
Polling is a pull model — you ask repeatedly. Webhooks are a push model — the source calls you when something happens. The difference isn't just efficiency: event-driven systems have lower latency, lower cost, and simpler logic because you don't need to track "what's new since last check."

The Concept

Polling vs Webhooks vs Scheduled

Trigger Type	How It Works	Latency	Cost	Best For
Webhook	Source calls your URL when event occurs	Real-time (< 1s)	Zero wasted calls	External systems that support webhooks
Scheduled	n8n runs at fixed intervals (cron)	Interval-dependent	Fixed cost per run	Batch jobs, cleanup, reminders
Polling	Workflow calls API every N minutes to check for changes	N minutes average	High (most polls return nothing)	Systems without webhook support
Manual	User clicks "Execute"	On-demand	Zero	Admin tasks, testing

Webhook Architecture in n8n

┌──────────────┐     HTTP POST      ┌──────────────────┐
│  External    │ ──────────────────> │  n8n Webhook     │
│  System      │  (event payload)    │  Node            │
│  (Stripe,    │                     │                  │
│   Slack,     │                     │  ↓               │
│   GitHub,    │                     │  [Process]       │
│   Custom)    │                     │  ↓               │
│              │ <────────────────── │  [Respond]       │
└──────────────┘   HTTP Response     └──────────────────┘

Webhook Authentication Methods

Method	How It Works	Security Level	Use Case
None	Anyone with the URL can trigger	Low	Testing, internal networks
API Key	Header check: `X-API-Key: secret`	Medium	Internal services, simple integrations
HMAC Signature	Verify signature of payload using shared secret	High	Stripe, GitHub, Shopify webhooks
OAuth	Token-based, scoped permissions	High	Third-party platform integrations
Basic Auth	Username/password in header	Medium	Legacy systems

Stripe sends you a webhook when a payment succeeds. A malicious user discovers your webhook URL and sends fake "payment succeeded" events to get free access. How do you prevent this?

HMAC signature verification is the standard solution. Stripe signs every webhook payload with your signing secret. You compute the HMAC of the received payload and compare it to the signature in the header. If they don't match, the payload was tampered with or sent by someone without your secret. This is why Stripe (and GitHub, Shopify, etc.) provide webhook signing secrets.

Synchronous vs Asynchronous Webhooks

Mode	How It Works	When to Use
Synchronous	n8n processes the event and returns the result in the HTTP response	Fast processing (< 30s), caller needs the result
Asynchronous	n8n returns 200 OK immediately, processes in background	Slow processing, caller only needs acknowledgment

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Build It, Use It, Ship It, Exercises, Key Terms, Common Pitfalls — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.