{
  "name": "Toolbench lead.created (verify signature)",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "toolbench-leads",
        "responseMode": "onReceived",
        "options": {}
      },
      "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "name": "Toolbench Webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [380, 300],
      "webhookId": "toolbench-leads"
    },
    {
      "parameters": {
        "mode": "runOnceForAllItems",
        "jsCode": "const crypto = require('crypto');\nconst secret = $env.TB_WEBHOOK_SECRET;\nconst item = $input.first();\nconst header = item.headers?.['toolbench-signature'] ?? item.headers?.['Toolbench-Signature'] ?? '';\nconst rawBody = typeof item.binary?.data?.data === 'string'\n  ? Buffer.from(item.binary.data.data, 'base64').toString('utf8')\n  : JSON.stringify(item.json.body ?? item.json);\nconst parts = Object.fromEntries(header.split(',').map(p => { const i = p.indexOf('='); return [p.slice(0,i), p.slice(i+1)]; }));\nconst t = Number(parts.t);\nconst v1 = parts.v1;\nif (!secret || !t || !v1 || Math.abs(Date.now()/1000 - t) > 300) throw new Error('Invalid Toolbench-Signature');\nconst expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`, 'utf8').digest('hex');\nif (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1))) throw new Error('Signature mismatch');\nreturn $input.all();"
      },
      "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
      "name": "Verify Toolbench-Signature",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [620, 300]
    },
    {
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{ $json.body?.type ?? $json.type }}",
              "operation": "equal",
              "value2": "lead.created"
            }
          ]
        }
      },
      "id": "c3d4e5f6-a7b8-9012-cdef-123456789012",
      "name": "lead.created?",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [860, 300]
    },
    {
      "parameters": {},
      "id": "d4e5f6a7-b8c9-0123-def0-234567890123",
      "name": "Your next step",
      "type": "n8n-nodes-base.noOp",
      "typeVersion": 1,
      "position": [1100, 260]
    }
  ],
  "connections": {
    "Toolbench Webhook": {
      "main": [[{ "node": "Verify Toolbench-Signature", "type": "main", "index": 0 }]]
    },
    "Verify Toolbench-Signature": {
      "main": [[{ "node": "lead.created?", "type": "main", "index": 0 }]]
    },
    "lead.created?": {
      "main": [[{ "node": "Your next step", "type": "main", "index": 0 }], []]
    }
  },
  "active": false,
  "settings": { "executionOrder": "v1" },
  "meta": {
    "templateCredsSetupCompleted": false,
    "description": "Import into n8n, set TB_WEBHOOK_SECRET to your whsec_… signing secret, activate, then register the production Webhook URL with POST /webhooks for lead.created."
  }
}