# Secure GitHub webhooks with HMAC256: n8n workflow template

> Started by another system calling it, and works across GitHub. 7 steps, 1 branch: small enough to read in one sitting and change without fear.

Source: https://millionrounds.com/workflow/secure-github-webhooks-with-hmac256 (Millionrounds; every figure on the page links to its filing or article)

[Automation library](https://millionrounds.com/workflows) · [Documents and files](https://millionrounds.com/workflows?category=Documents+and+files#library)

# Secure GitHub webhooks with HMAC256

Started by another system calling it, and works across GitHub. 7 steps, 1 branch: small enough to read in one sitting and change without fear.

Small

[Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fsecure-github-webhooks-with-hmac256)

**7 steps** Small: readable in one sitting

**1** Branch: places the flow splits

**0** Loops or waits

**1** Service it connects to

## The flow

Starts it 3 Logic 2 Service 2

The steps in the order they run, from what starts it.

- 1 **GitHub Webhook** Webhook *Starts it*
- 2 **Compute HMAC256** Crypto *Service*
- 3 **Validate HMAC256** If *Logic*
- 4 **Respond 200 OK** Respond To Webhook *Starts it*
- 5 **Respond 401 Unauthorized** Respond To Webhook *Starts it*
- 6 **Get the profile of a repository** Github *Service*
- 7 **Stop and Error** Stop And Error *Logic*

## How it's built

- **Starts on:** Another system calling it
- **Steps:** 7, with 1 branch
- **Size:** Small: readable in one sitting
- **Connects to:** GitHub
- **Model:** None. This is plumbing, not judgement

## Questions

What does it need to run?

An n8n account, plus your own GitHub account. You connect your own accounts after importing it; none are included.

What starts it?

It starts on another system calling it.

Does it use AI?

No. Every step is fixed logic or a call to a service, so it does the same thing every time.

How long does it take to set up?

Not long. At 7 steps it can be read in one sitting and changed without fear.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

**Before you run it**

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 7 steps before you point it at anything that matters.

## Run it in n8n

- **Create your n8n account** Free to start. n8n is where the workflow runs. [Create an n8n account ↗](https://millionrounds.com/n8n)
- **Download the workflow** Free with a Millionrounds account. [Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fsecure-github-webhooks-with-hmac256)
- **Paste it into n8n** Open a new workflow in n8n and paste. Then connect your own accounts.

Stored with the author's traces removed: canvas notes, instance identifiers, saved credential names and any live document they had left behind.

## Connects to

Each opens the other workflows that use it.

[GitHub](https://millionrounds.com/workflows?service=GitHub#library)

## Workflows like it

Also documents and files, with the same services where possible, closest in size first.

- [**Sync workflows to GitHub repository files** 9 steps · GitHub](https://millionrounds.com/workflow/sync-workflows-to-github-repository-files)
- [**Automated daily workflow backup to GitHub** 10 steps · GitHub](https://millionrounds.com/workflow/automated-daily-workflow-backup-to-github)
- [**Backup workflows to git repository on GitHub** 10 steps · GitHub](https://millionrounds.com/workflow/backup-workflows-to-git-repository-on-github)
- [**GitHub auto-documentation on push with Slack** 10 steps · GitHub, Slack](https://millionrounds.com/workflow/github-auto-documentation-on-push-with-slack)
- [**Push and update files in GitHub** 10 steps · GitHub](https://millionrounds.com/workflow/push-and-update-files-in-github)
- [**Track SDK documentation drift with GitHub and Notion** 10 steps · GitHub, Google Sheets](https://millionrounds.com/workflow/track-sdk-documentation-drift-with-github-and-notion)