SignMaster and n8n, through the Webhook node

Before you start

You need SignMaster on Crew or Company, where webhooks are included, and an n8n instance SignMaster can reach at a public https:// address. SignMaster refuses localhost and private network addresses, so a self-hosted n8n needs a public hostname with HTTPS, for example behind a reverse proxy.

Set it up

1. 1

   Add a Webhook node

   Start a workflow with the Webhook trigger node. Set HTTP Method to POST and leave Authentication on None: SignMaster proves who it is with a signature header instead.

2. 2

   Answer straight away

   Set Respond to Immediately, so SignMaster gets its success code at once. SignMaster waits up to 5 seconds, and a slow step later in the workflow shouldn't count as a failed delivery.

3. 3

   Point SignMaster at the test URL

   Copy the node's Test URL and add it in Settings › Developers › Webhooks, ticking the events you want. Keep the signing secret SignMaster shows once.

4. 4

   Capture a real message

   Choose Listen for Test Event in n8n, then sign a test contract made from your template. SignMaster's own test message works too, but it has no field values to map.

5. 5

   Go live

   Edit the SignMaster endpoint to use the Production URL instead, then publish the workflow so that URL starts listening.

Working with the data

The Webhook node outputs the request as body, headers, params and query, so SignMaster's message sits under body. In an expression, a field labeled Contract price is $json.body.data.fields_by_label['Contract price'], and on recipient.completed the person who just finished is $json.body.data.recipient.

• Route events with an IF or Switch node on $json.body.type, so envelope.completed and envelope.declined take different branches.
• Fetch the signed PDF from body.data.signed_pdf.url with an HTTP Request node set to return a file, within 24 hours of the event.
• Write the answers on with nodes like Google Sheets Append Row, HubSpot's contact create-or-update operation, or Slack's message Send operation.

Verify the signature

Because n8n can run code, it's a good place to check that a message really came from SignMaster. The SignMaster-Signature header reads t= a Unix timestamp, then v1= a hex HMAC-SHA256. Compute the HMAC of the timestamp, a dot and the request body with your secret, using the Crypto node or a Code node, and compare. Reject timestamps more than five minutes old. Hash the body exactly as it arrived: the Webhook node's Raw Body option keeps it unparsed.

Messages can occasionally arrive twice. Store body.id, which starts with evt_ and stays the same on every retry, and skip any id you've already handled.