# n8n webhook: how the Webhook node and its test and production URLs work > The n8n Webhook node starts a workflow when another app or script sends it an HTTP request. It has two URLs. The test URL answers while you listen for a test event and shows the data in the editor. The production URL answers once the workflow is published and logs its runs in the Executions tab. This lesson builds one and calls both with curl. Mindket editors · Published 2026-11-04 · Updated 2026-11-05 · https://mindket.com/learn/n8n/n8n-webhook ## In short - Build a Webhook node that accepts a POST request and replies with data. - Tell the test URL and the production URL apart, and know when each one answers. - Call a webhook from a terminal with curl. - Choose how the webhook responds, and how to lock it down. ## Before you start You need an n8n instance, such as the one from [lesson 1](https://mindket.com/learn/n8n/n8n-first-workflow), and a terminal with `curl`. In Windows PowerShell 5.1, `curl` is an alias for another command, so type `curl.exe` there. Both calls below come from the same machine, so nothing has to be reachable from the internet yet. An outside service calling n8n on your laptop is a different problem, and the common mistakes section says why. ## Build a webhook and call it with curl The webhook below takes a name in a POST request and sends a greeting back. The code shows both calls in n8n's own [curl form](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.webhook/common-issues): the first goes to the test URL, the second to the production URL. Copy the real URL from the Webhook node, because your host and path will differ. ````bash curl --request POST --data 'name=Ada' curl --request POST --data 'name=Ada' ```` 1. Create a workflow and add a **Webhook** node as its trigger. 2. Set **HTTP Method** to POST. The node accepts one method by default, so a request with another method doesn't match. 3. Leave **Path** alone or type your own, such as `hello`. n8n fills in a random path by default, to avoid clashes with other webhooks. 4. Set **Respond** to **When Last Node Finishes** and **Response Data** to **First Entry JSON**. 5. Select **Listen for test event**. n8n registers the test URL and keeps it active for 120 seconds. Run the first command from the code above. The request appears as data in the node. 6. Add an **Edit Fields (Set)** node after the Webhook. Add a field called `greeting`. For **Value**, type "Hello, " and drag `name` in from the **INPUT** panel, where it sits under `body`. The [expression](https://docs.n8n.io/build/work-with-data/transform-data/expressions-for-data-transformation) becomes `{{ $json.body.name }}`. 7. Select **Execute workflow**, which registers the test URL again, and send the same command. The terminal prints the Edit Fields node's output as JSON. 8. Switch the Webhook node to its **Production URL** and **Publish** the workflow. Run the second command. Nothing shows in the editor this time, so open the **Executions** tab to see the run. ## Test URL or production URL The Webhook node shows both URLs at the top of its panel, and a toggle switches which one is displayed, per the [node's page](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.webhook). They differ in when they answer. The workflow behind them is the same one. The path segments come from two settings, `N8N_ENDPOINT_WEBHOOK` and `N8N_ENDPOINT_WEBHOOK_TEST`, which a [self-hosted instance](https://docs.n8n.io/deploy/host-n8n/configure-n8n/basic-configuration/use-environment-variables/endpoints) can change. On localhost, n8n tells you to run in tunnel mode so outside services can reach the webhook. n8n's [Docker page](https://docs.n8n.io/deploy/host-n8n/install-options/install-with-docker) calls the tunnel a local development tool and warns against it in production. | What differs | Test URL | Production URL | | --- | --- | --- | | Registered when | You select Listen for test event or Execute workflow, with the workflow unpublished | You publish the workflow | | How long it answers | About 120 seconds after you start listening | Until you unpublish the workflow | | Where the data appears | In the editor | In the workflow's Executions tab | | Default path segment | `webhook-test` | `webhook` | | Use it for | Building and debugging | The real service that calls you | ## Choosing how the webhook answers The **Respond** setting on the Webhook node decides what the caller gets. **Immediately** returns the response code and the message "Workflow got started". **When Last Node Finishes** returns the last node's output, and **Response Data** picks all entries, the first entry as JSON, the first entry's binary data or no body. **Streaming response** sends data back while the workflow runs, and it needs nodes that can stream, such as the AI Agent node. For a reply from the middle of the workflow, set **Respond** to **Using 'Respond to Webhook' node** and add the [Respond to Webhook node](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.respondtowebhook) wherever it belongs. - The node runs once, with the first incoming item, even inside a loop. A second Respond to Webhook that runs later is ignored. - Its **Respond With** menu offers All Incoming Items, Binary File, First Incoming Item, JSON, JWT Token, No Data, Redirect and Text. Text sends HTML by default. - A workflow that finishes without reaching the node returns the standard message with a 200 status. One that fails before it returns an error with a 500 status. - Since n8n 1.103.0, an HTML response is wrapped in a sandboxed iframe. Relative URLs inside it do not work, so use absolute ones. ## Limits and locks With authentication set to None, anyone who has the URL can call it. The Webhook node offers real locks, and the counts below set its limits. Each request that starts the trigger also counts as one [execution](https://docs.n8n.io/build/understand-workflows/understand-executions) on a paid plan. **Three numbers to remember** - **120** seconds a test webhook stays active after you select Listen for test event (Source: [n8n Docs: Webhook workflow development](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.webhook/workflow-development), read 2026-11-04) - **16 MB** the largest request body a webhook takes by default (Source: [n8n Docs: Webhook node](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.webhook), read 2026-11-04) - **100** seconds before Cloudflare fails a webhook request on n8n Cloud with a 524 status (Source: [n8n Docs: Webhook common issues](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.webhook/common-issues), read 2026-11-04) - Pick an authentication method on the node: Basic auth, Header auth or JWT auth through Webhook credentials, n8n User Auth (OAuth2), or None. - Fill **IP(s) Allowlist** with the addresses allowed to call the URL. Any other address gets a 403. - **Allowed Origins (CORS)** defaults to `*`, which allows every origin. - For a job that runs past 100 seconds on n8n Cloud, answer at once from one webhook and let the caller poll a second one for the result. ## What n8n's team and the maker of n8n-skills say about webhook data The n8n team [announced chat streaming on X](https://x.com/n8n_io/status/1960613359037886710) on 27 August 2025, with word-by-word replies as the selling point. On the Webhook node that is the **Streaming response** mode. n8n's [streaming page](https://docs.n8n.io/build/understand-workflows/understand-executions/stream-real-time-responses) names two nodes that can stream, the AI Agent and Respond to Webhook. A caller waiting on a long answer starts reading text before the run ends. Romuald Członkowski, who works at AiAdvisors in Warsaw, made [n8n-skills](https://github.com/czlonkowski/n8n-skills), a set of Claude Code skills for building n8n workflows. The repository had 6.6k stars on GitHub on 5 November 2026. Its expression skill marks one trap as critical: a webhook puts the posted data under `body`. Step 6 drags `name` from under `body` for that reason, and the expression ends up as `{{ $json.body.name }}`. If an expression on webhook data comes back empty, look for the missing `body` first. > Critical gotcha: Webhook data is under `$json.body` > > Romuald Członkowski, Creator of n8n-skills, AiAdvisors, [GitHub](https://github.com/czlonkowski/n8n-skills) (read 2026-11-05) [![n8n.io (@n8n_io) on X, 27 August 2025. Chat streaming has landed in n8n. Faster. Smoother. Word-by-word replies. Feels just like the chat experiences you already know and love, but now powered by your favorite automations.](https://mindket.com/blog/shots/x-n8n-io-chat-streaming.webp?v=d4d712ff0800)](https://x.com/n8n_io/status/1960613359037886710) n8n.io on X, 27 August 2025 [n8n Beginner Course (2/9) - Introduction to APIs and Webhooks](https://www.youtube.com/watch?v=y_cpFMF1pzk) Part 2 of the Beginner Course on n8n's own YouTube channel introduces APIs and webhooks. > A screenshot of X's own embed of the post, taken on 5 November 2026, with the time in UTC. Select it to open the post on X. ## Common mistakes - Calling the test URL when nobody is listening. It answers only while n8n is listening, which starts when you select **Listen for test event** or **Execute workflow**. - Calling the production URL before you publish. n8n registers a production webhook when you publish the workflow, not before. - Sending the wrong HTTP method. To accept more than one, turn on **Allow Multiple HTTP Methods** in the node's **Settings** and add methods in **HTTP Methods**. The node then gets one output per method. - Giving two workflows the same path. n8n allows one webhook per path and method pair and says yours is already in use. Unpublish the other workflow or change a path or a method. - Calling from an HTTP Request node with a different method than the webhook uses. Match the two, and for the test URL execute the workflow with the Webhook node first. - Letting an allowlist see only the proxy. Behind a reverse proxy, set `N8N_PROXY_HOPS` to the number of proxies. The same setup shows the wrong URL in the editor until you set `N8N_WEBHOOK_URL`, which [lesson 4](https://mindket.com/learn/n8n/self-host-n8n-docker) covers and the [proxy page](https://docs.n8n.io/deploy/host-n8n/configure-n8n/basic-configuration/configuration-examples/configure-webhook-urls-with-reverse-proxy) describes. ## Try it yourself - Set **IP(s) Allowlist** to an address that is not yours, call the production URL and see what comes back. Clear the list afterwards. - Add an authentication method to the node, then call it once without credentials and once with them. - Add a Respond to Webhook node that returns JSON with a custom response code, and check the code in the terminal. - Send a GET request to your POST-only webhook and read what comes back. ## What to learn next A webhook can also feed an agent, and its streaming response mode exists for that. [Lesson 3](https://mindket.com/learn/n8n/n8n-ai-agent) builds an AI agent from a chat model, memory and tools. If you want finished workflows built around triggers like this one, [importing an n8n workflow](https://mindket.com/blog/import-n8n-workflow) shows how a store download becomes a running copy on your own instance. ## Check yourself 1. Your curl call to the test URL gets no reply. What do you do? A. Publish the workflow B. Raise the request size limit C. Select Listen for test event, then call it again within 120 seconds D. Add an IP allowlist Answer: C. The test URL answers only while n8n is listening, and it stays active for 120 seconds after you select Listen for test event. 2. Which Respond setting lets the webhook reply from the middle of the workflow? A. Using 'Respond to Webhook' node B. Immediately C. When Last Node Finishes D. Streaming response Answer: A. With that setting you add the Respond to Webhook node wherever the reply belongs, and only its first run sends a response. 3. How do you let one webhook accept both GET and POST? A. Create two Webhook nodes with the same path and method B. Set HTTP Method to ANY C. Leave Path empty D. Turn on Allow Multiple HTTP Methods in the node's Settings Answer: D. The node takes one method by default, and the switch in Settings lets you list several, with one output for each method. 4. Which setting returns a 403 to every address you did not list? A. Allowed Origins (CORS) B. IP(s) Allowlist C. Respond With D. Path Answer: B. IP(s) Allowlist holds the addresses allowed to call the URL, while Allowed Origins (CORS) defaults to * and allows every origin. ## Frequently asked questions ### Can I send a file to an n8n webhook? Yes. Send it as form data, for example with curl's `--form 'key=@/path/to/file'`, and set the node's **Binary Property** option, which names the property that receives the file. That option needs POST, PATCH or PUT. ### Can one n8n webhook accept both GET and POST? Yes. By default the node takes one method, but the **Allow Multiple HTTP Methods** switch in its Settings lets you list several. n8n then gives the node one output for each method. ### How big a request can an n8n webhook receive? Up to 16 MB by default. A self-hosted instance can change that with the `N8N_PAYLOAD_SIZE_MAX` variable, which is in MiB and needs a restart, per the [endpoint variables](https://docs.n8n.io/deploy/host-n8n/configure-n8n/basic-configuration/use-environment-variables/endpoints). ### How do I secure an n8n webhook? Combine an authentication method with an IP allowlist. The node supports Basic, Header and JWT auth, n8n User Auth through OAuth2, and an allowlist that returns a 403 to every other address. ### Do I need a public address to test a webhook on my laptop? Only when the caller lives elsewhere. A curl command on the same machine needs nothing. For a service on the internet, put n8n on a server with a public address, or use n8n's tunnel mode while you develop. ### Does an n8n webhook time out? The Webhook page gives no limit of its own. On n8n Cloud, a webhook that has not answered within 100 seconds fails with a 524 status from Cloudflare, so long jobs need two webhooks, one to start and one to poll. ### Can an n8n webhook return an HTML page? Yes, with the [Respond to Webhook node](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.respondtowebhook) set to Text, which sends HTML by default. Expect the page to sit inside a sandboxed iframe, so it cannot read the top window or use relative links. ## Sources - [n8n Docs: Webhook node](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.webhook) (read 2026-11-04) - [n8n Docs: Webhook workflow development](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.webhook/workflow-development) (read 2026-11-04) - [n8n Docs: Webhook common issues](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.webhook/common-issues) (read 2026-11-04) - [n8n Docs: Respond to Webhook node](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.respondtowebhook) (read 2026-11-04) - [n8n Docs: Endpoints environment variables](https://docs.n8n.io/deploy/host-n8n/configure-n8n/basic-configuration/use-environment-variables/endpoints) (read 2026-11-05) - [n8n Docs: Configure webhook URLs with a reverse proxy](https://docs.n8n.io/deploy/host-n8n/configure-n8n/basic-configuration/configuration-examples/configure-webhook-urls-with-reverse-proxy) (read 2026-11-04) - [n8n Docs: Expressions for data transformation](https://docs.n8n.io/build/work-with-data/transform-data/expressions-for-data-transformation) (read 2026-11-04) - [n8n Docs: Understand executions](https://docs.n8n.io/build/understand-workflows/understand-executions) (read 2026-11-04) - [n8n Docs: Install with Docker](https://docs.n8n.io/deploy/host-n8n/install-options/install-with-docker) (read 2026-11-04) - [n8n Docs: Stream real-time responses](https://docs.n8n.io/build/understand-workflows/understand-executions/stream-real-time-responses) (read 2026-11-05) - [n8n.io on X: chat streaming has landed in n8n, 27 August 2025](https://x.com/n8n_io/status/1960613359037886710) (read 2026-11-05) - [Romuald Członkowski on GitHub: n8n-skills](https://github.com/czlonkowski/n8n-skills) (read 2026-11-05) - [n8n on YouTube: n8n Beginner Course (2/9) - Introduction to APIs and Webhooks](https://www.youtube.com/watch?v=y_cpFMF1pzk) (read 2026-11-05) [Read the import guide](https://mindket.com/blog/import-n8n-workflow)