n8n AppsMax Webhook HMAC-SHA256 Verify & Forward Leads

Verify AppsMax webhook authenticity with HMAC-SHA256—then forward only new leads

This n8n workflow secures your AppsMax integrations by verifying incoming webhook signatures using HMAC-SHA256, filters for application.created events only, and forwards those leads to your external HTTPS API. AppsMax receives success only when your destination responds with 2xx.

What this workflow does

• Receives AppsMax webhook POST requests and preserves the raw request body for cryptographic verification.
• Computes HMAC-SHA256 of the raw payload and compares it to the lowercase-hex X-Appsmax-Signature header.
• If the signature is invalid, it returns 401 and does not process the payload.
• Filters events to forward only application.created. Other valid events (including application.test) return 204 without calling your destination.
• Uses Edit Fields to select the minimum lead data and generates a stable idempotency key based on the event and application state.
• Forwards the JSON payload via HTTP Request to your HTTPS endpoint, sending Idempotency-Key and X-Appsmax-Event headers.
• Delivery reliability: a downstream 2xx returns 200 to AppsMax; 4xx/5xx/timeouts/network failures return 502 so AppsMax can retry per its delivery policy.

Use cases

• Send new AppsMax application leads to a CRM or custom lead intake service with verified authenticity.
• Prevent duplicate lead creation using idempotency when AppsMax retries webhook deliveries.
• Ignore non-production or test events (application.test) while still acknowledging them safely.

Technical details

• n8n nodes: webhook, crypto, code, if, set, plus sticky note guidance.
• Uses an n8n Crypto credential with the AppsMax secret placed in the HMAC Secret field (attached to the HMAC verification node).
• Relies on AppsMax headers: X-Appsmax-Signature and event type filtering (application.created).