How do I securely verify a WhatsApp webhook in n8n using environment variables?

Below is some guidance on how to securely check the verification token in your n8n workflow and ensure that your webhook properly responds to Meta’s challenge:

---

1. Using Environment Variables in n8n Expressions

Your goal of storing the verify token as an environment variable (set in your docker-compose file) is a solid security practice. In n8n, you can access environment variables in expressions using the $env object. For example, inside a Function or Set node you can do a comparison like:

JAVASCRIPTCopied
// In a Function node
const verifyToken = $json["query"]["hub.verify_token"];
const challenge = $json["query"]["hub.challenge"];
const tokenCorrect = verifyToken === $env["WHATSAPP_VERIFY_TOKEN"];

if (tokenCorrect) {
  return { json: { challenge } };
} else {
  return { json: { error: "Invalid token" } };
}

If you want to use a direct expression (for instance in a Set node’s value field), you can write:

={{ $json["query"]["hub.verify_token"] === $env["WHATSAPP_VERIFY_TOKEN"] ? $json["query"]["hub.challenge"] : "TOKEN_MISMATCH" }}

This expression checks if the received token matches your stored environment variable, returning the challenge if successful.

---

2. Using the Webhook Node

Keep in mind that when Meta sends the hub.challenge, your webhook must return it exactly as received with an HTTP 200 status. This means that if you’re using an n8n workflow with a Webhook node as the entry point, you’ll have to ensure that:

• The webhook node’s response is generated only after you verify the token.
• The returned response is in plain text (not JSON) because Meta expects the challenge as the plain text body.

For this, you might need to use a Function node that sits immediately after the Webhook node and then output the challenge. Then, use an HTTP Response node (if available) or configure your workflow to return the plain text response.

---

3. Best Practices for Production

• Keep Secrets Out of the Workflow: Storing your verify token in the environment (as you’re doing in docker-compose) is preferred over hardcoding it.
• Use a Secure Reverse Proxy or API Gateway: Since your n8n instance is exposed, ensure that only legitimate traffic from Meta’s IPs reaches your webhook.
• Monitor Webhook Response: The error you’re seeing (e.g. curl_errno = 28; Connection timed out) might indicate network connectivity issues. Double-check that Meta can reach your webhook endpoint via Cloudflare and that there are no firewall or SSL/TLS misconfigurations.

---

4. Summary

Your approach using an environment variable is valid. The snippet you provided—in the context of a Function node or within an expression—is on the right track. Here’s a consolidated example inside a Function node:

JAVASCRIPTCopied
// Function node to verify token and return the challenge
const verifyToken = $json["query"]["hub.verify_token"];
const challenge = $json["query"]["hub.challenge"];

if (verifyToken === $env["WHATSAPP_VERIFY_TOKEN"]) {
  // Return the challenge as the plain text response
  // (Depending on your workflow, you might need additional configuration to send plain text)
  return { json: { challenge } };
} else {
  // Optionally log error or return a 400 response
  return { json: { error: "Invalid verify token" } };
}

Make sure that the response reaches Meta in the format they expect.

---

This method keeps your token secure and leverages n8n’s built-in handling of environment variables, while also giving you full control over the verification process.