Monitor web changes with n8n

The mental model: a webhook starts the workflow

An automation platform is event driven, so it fits the push pattern. You add an n8n Webhook trigger node, register its URL as a Hypeline webhook, and point it at the sources you care about. Each real change becomes a signed POST that starts one workflow run, with the event as input. No schedule, no wasted polls.

Register the webhook

Copy the Production URL from your n8n Webhook node. In Hypeline a webhook is a destination on an alert: first create an alert (the sources to watch plus a filter), then add a webhook destination to it. The destination create response reveals a whsec_ signing secret exactly once, which you keep for verification. Both calls use your dashboard session token, or you can add the alert and destination in the dashboard UI.

# 1. Create an alert: a filter plus the sources to watch (empty = your whole library).
curl -X POST https://api.hypeline.io/v1/alerts \
  -H "Authorization: Bearer $HYPELINE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"filter_query":"price OR plan","language":"en","source_ids":[]}'

# 2. Add your n8n Webhook URL as a destination on that alert (secret revealed once).
curl -X POST https://api.hypeline.io/v1/alerts/{alert_id}/destinations \
  -H "Authorization: Bearer $HYPELINE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"kind":"webhook","url":"https://n8n.example/webhook/hypeline"}'

Verify the signature, then act

Hypeline signs every delivery with the Standard Webhooks HMAC scheme. Verify it in a Code node before the workflow trusts the payload, so a forged request cannot trigger your automation.

const crypto = require('crypto');
const secret = 'whsec_...';                 // from the destination create response

const headers = $input.first().json.headers;
const raw = $input.first().json.body;       // exact bytes as received
const id = headers['webhook-id'];
const ts = headers['webhook-timestamp'];

// Derive the raw HMAC key: strip the whsec_ prefix, standard-base64-decode.
const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
const signed = `${id}.${ts}.${raw}`;
const digest = crypto.createHmac('sha256', key).update(signed).digest('base64');

const sent = headers['webhook-signature'].split(' ').map(s => s.split(',')[1]);
if (!sent.includes(digest)) throw new Error('bad signature');

return [{ json: JSON.parse(raw) }];         // verified event flows downstream

From here, wire the verified event into any n8n node: post the change to Slack, open a ticket, append a row, or call another API. The event carries the source URL, a title, the extracted content, and timestamps on one stable schema.

Why Hypeline, not a page-change checker

• Deduplicated on extracted content. A workflow runs on real changes to the main text, not on ads, banners, or timestamps.
• One schema across every source. Feeds, watched pages, and streaming sources all deliver the same event shape, so one workflow handles a mixed set of sources.
• Signed and safe. Every delivery is HMAC-signed, so only genuine Hypeline events can start the workflow.
• No duplicate runs. Because the same change is never re-emitted, a source that mutates on every load does not spam your automation.