Verify HMAC-SHA256 signed webhook requests before any business logic runs

## Verify a signed webhook before business logic ### Who this is for Automation teams receiving server-to-server webhooks from a provider that signs the exact request body with HMAC-SHA256. ### Contract used by this template - Header: X-Automation-Signature: sha256= - Signature input: the exact raw request body bytes - Body fields: event_id, signed Unix timestamp sent_at, and payload - Freshness: no more than 300 seconds old or 60 seconds in the future ### Set up 1. Keep the workflow inactive after import. 2. Create an n8n Crypto credential with the shared HMAC secret. 3. Assign it to Compute Body HMAC. 4. Match the provider's exact header, canonical string, digest encoding, and timestamp rules. 5. Add business nodes only after the true output of Is Request Authentic and Fresh. ### Boundaries The timestamp limits replay time but does not stop duplicate delivery inside the five-minute window. Add persistent event-ID deduplication for strict once-only handling. Apply rate and body-size limits before n8n. Generic 401 responses avoid exposing which check failed. The public workflow contains no credential or real data.