Restrict Webhook Access With Authentication and IP Allowlisting

Public webhook URLs are discoverable through URL scanning and can be abused for data injection, denial of service, or triggering unintended workflow executions. Add at least one layer of authentication to every sensitive webhook endpoint -- header authentication in the Webhook node, IP allowlisting at the reverse proxy, or basic auth for internal tools -- and combine layers for defense in depth.

Real-world example: An n8n webhook endpoint creates records in a production database. An attacker discovers the URL and sends thousands of crafted POST requests, inserting garbage data.

How do you protect a webhook with header authentication?

Configure the Webhook node:

Setting	Value
Authentication	Header Auth
Header Name	X-Webhook-Secret
Header Value	(create a credential with a strong random value)

Callers must include the header:

curl -X POST https://n8n.example.com/webhook/your-path \
  -H "X-Webhook-Secret: your-random-secret-value" \
  -H "Content-Type: application/json" \
  -d '{"event": "order.created", "data": {...}}'

How do you restrict a webhook by IP address?

Restrict the webhook paths by IP at the Nginx layer:

# Inside the server block, restrict webhook paths by IP

location /webhook/ {
    # Only allow requests from known IP ranges

    allow 52.31.0.0/16;    # Stripe webhook IPs

    allow 192.30.252.0/22; # GitHub webhook IPs

    allow 10.0.0.0/8;      # Internal network

    deny all;

    proxy_pass http://127.0.0.1:5678;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

How do you use basic auth for internal webhooks?

Configure the Webhook node:

Setting	Value
Authentication	Basic Auth
Credential	(create a Basic Auth credential with username/password)

Tip: Combine Methods

For maximum protection on critical webhooks, use IP allowlisting at the Nginx layer AND header authentication in the Webhook node. This provides defense in depth -- even if one layer is bypassed, the other blocks unauthorized access.

Related: Use Docker Compose with Health Checks for n8n and PostgreSQL · Use Path Parameters in Webhook URLs for Dynamic Routing