POLLING (Schedule Trigger):
Your workflow → "Any new orders?" → Shopify → "No"
[5 min later]
Your workflow → "Any new orders?" → Shopify → "No"
[5 min later]
Your workflow → "Any new orders?" → Shopify → "Yes, 1 order!"
→ 10 minutes wasted checking, potential delay of up to 5 min

WEBHOOK (Instant):
Shopify → "New order!" → Your workflow (instantly)
→ 0 delay, 0 wasted checks

n8n Workflow Setup:

1. Add node: "Webhook" (under Triggers)
2. HTTP Method: POST (most common)
3. Path: /my-webhook-path (becomes part of the URL)
4. Authentication: None (for testing) / Header Auth (for production)
5. Response Mode: "When Last Node Finishes" (send response after processing)

Your webhook URL will be:
TEST:  https://your-n8n.domain/webhook-test/my-webhook-path
PROD:  https://your-n8n.domain/webhook/my-webhook-path

[Webhook: /shopify-order]
    │
    ▼
[Set Node: Extract order data]
    │ customer_name = {{$json.customer.first_name}}
    │ phone = {{$json.customer.phone}}
    │ total = {{$json.total_price}}
    │ items = {{$json.line_items.map(i => i.title).join(', ')}}
    │
    ▼
[IF Node: Has phone number?]
    │
    ├── YES ──▶ [HTTP Request: WATI API]
    │           POST https://live-server.wati.io/api/v1/sendTemplateMessage
    │           Body: { phone: "+92...", template: "order_confirm",
    │                   parameters: [name, total, items] }
    │
    └── NO ───▶ [Gmail: Send email confirmation instead]

[Webhook: /typeform-response]
    │
    ▼
[Set Node: Parse Typeform payload]
    │ name = {{$json.form_response.answers[0].text}}
    │ email = {{$json.form_response.answers[1].email}}
    │ interest = {{$json.form_response.answers[2].choice.label}}
    │
    ▼
[Google Sheets: Append Row]
    │ Sheet: "Leads"
    │ Values: [name, email, interest, timestamp]
    │
    ▼
[Gmail: Send welcome email]
    │ To: {{$json.email}}
    │ Subject: "Thanks for signing up, {{$json.name}}!"
    │ Body: [template with interest-specific content]
    │
    ▼
[Respond to Webhook: 200 OK]

[Webhook: /stripe-payment]
    │
    ▼
[IF Node: event.type === "payment_intent.succeeded"]
    │
    ├── YES ──▶ [Set: Extract payment data]
    │           │ amount = {{$json.data.object.amount / 100}}
    │           │ email = {{$json.data.object.receipt_email}}
    │           │ product = {{$json.data.object.metadata.product_id}}
    │           │
    │           ▼
    │           [Switch: Product type]
    │           ├── "course" → [HTTP: Grant course access]
    │           ├── "ebook" → [Gmail: Send download link]
    │           └── "service" → [Slack: Notify team]
    │
    └── NO ───▶ [Stop and Respond: 200 OK (acknowledge but ignore)]

Webhook Node Settings:
- Authentication: Header Auth
- Header Name: X-Webhook-Secret
- Header Value: your-secret-key-here-abc123

The sending service must include this header:
X-Webhook-Secret: your-secret-key-here-abc123

Without it → n8n returns 401 Unauthorized

// Function Node: Verify Shopify HMAC Signature
const crypto = require('crypto');

const secret = 'your-shopify-webhook-secret';
const hmac = crypto.createHmac('sha256', secret);
const body = JSON.stringify($input.first().json);
hmac.update(body, 'utf8');
const calculated = hmac.digest('base64');

const received = $input.first().headers['x-shopify-hmac-sha256'];

if (calculated !== received) {
  throw new Error('Invalid webhook signature — request rejected');
}

return $input.all();

IF Node: Check source IP
Condition: {{$json.headers['x-forwarded-for']}} is in allowed list

Allowed IPs for common services:
- Stripe: 54.187.174.169, 54.187.205.235, ...
- Shopify: Published in their docs
- GitHub: 140.82.112.0/20

□ Use Header Auth or signature verification (NEVER leave unprotected)
□ Validate the payload structure before processing
□ Use HTTPS only (n8n cloud does this automatically)
□ Log all webhook calls for audit trail
□ Set up rate limiting (IF node: reject if >100 calls/minute)
□ Validate required fields exist before processing

Webhook → Process → Respond with result

Use when: The sender needs to know the result
Example: Form submission → validate → return success/error message
Setting: Response Mode = "When Last Node Finishes"

Webhook → Respond 200 OK immediately → Process in background

Use when: Processing takes time and sender just needs acknowledgment
Example: Shopify order → send 200 OK → process order in background
Setting: Response Mode = "Immediately"

Webhook → Validate → IF valid → Process → 200 OK
                    → IF invalid → 400 Bad Request

Use when: You need to reject bad payloads
Implementation: Use "Respond to Webhook" node in both branches