Integrations

n8n in minutes.

A ready-made workflow ships in the Disputek repo: webhook trigger, signature verification, and a chargeback lookup, already wired. Import it, set two variables, add your key, and activate.

What the template does

  • WebhookDisputek Events Receives Disputek deliveries at /webhook/disputek-events on your instance. rawBody is on, so the node hands the Code node the exact bytes that were signed.
  • CodeVerify Disputek Signature Recomputes the HMAC-SHA256 over the raw body with your endpoint secret and throws unless it matches the x-disputek-signature header. An invalid delivery fails the execution instead of flowing onward.
  • HTTP RequestList Chargebacks Fetches the one chargeback the event was about, using your API key. This is the seam: wire Slack, an ERP, or finance tooling off this node.

The template lives at integrations/n8n/disputek-workflow.json in the Disputek repository. It is a plain n8n export - no custom nodes, no community packages, nothing to install beyond n8n itself.

Install it

  1. 1Download disputek-workflow.json from Disputek’s repository (the link below), then in n8n go to Workflows, Import from File, and select it.
  2. 2Set two environment variables: DISPUTEK_API_URL (the public Disputek API base URL, with or without a trailing slash) and DISPUTEK_WEBHOOK_SECRET (the whsec_ secret for the endpoint you are about to create). In n8n Cloud these go under Settings - Environment Variables; self-hosted, they are instance env vars.
  3. 3Open the List Chargebacks node, choose Credential - Create New, pick Generic Credential Type - HTTP Bearer Auth, and paste a dk_ API key from Disputek Settings - API Keys. The node asks for the chargeback named in the event that fired the workflow, so each run handles one chargeback rather than a page of them.
  4. 4Activate the workflow. The production webhook URL is https://your-instance/webhook/disputek-events - paste that into a new endpoint under Disputek Integrations - Webhooks, tick the events you want, and press Test.
  5. 5A green DELIVERED row in the Disputek delivery log means the signature check passed end to end. If it failed, the n8n execution shows the mismatch.

Download disputek-workflow.json : a filename with nowhere to get it is an instruction a visitor to this page cannot follow.

The rawBody rule

This is the one setting people get wrong, so it is worth stating plainly: the Webhook node must run with rawBody enabled. The signature is computed over the exact payload bytes, so the Code node has to receive the raw body. Hand it n8n's re-serialized JSON instead and the digest will never match - which looks exactly like a bad secret, and sends you hunting the wrong problem.

const crypto = require("node:crypto");

// rawBody, not the parsed JSON: the signature covers the exact bytes.
const raw = $input.first().json.rawBody;
const provided = $input.first().json.headers["x-disputek-signature"];
const expected =
  "sha256=" +
  crypto
    .createHmac("sha256", $env.DISPUTEK_WEBHOOK_SECRET)
    .update(raw)
    .digest("hex");

if (provided !== expected) {
  throw new Error("Disputek signature mismatch");
}

return $input.all().map((item) => ({
  json: JSON.parse(raw.toString("utf8")),
}));

What Disputek sends

The workflow handles all three events, so you can subscribe the endpoint to whichever ones you need - or all of them. Deliveries are signed, retried up to four times on 5xx and network errors with a 1s, 10s, 60s backoff, and time out after 10 seconds. A failing endpoint is recorded on the delivery log and never blocks your analysis runs.

That log is also your recovery path, and for n8n it is the one you will need: an instance that is down for a version upgrade, a container restart or a crash misses the events sent while it was gone, and nothing retries past the fourth attempt. The endpoint card shows an undelivered count, and each failed delivery can be re-sent from the log - the same payload, re-signed, so the workflow's own verification node accepts it unchanged.

The template's own shape is covered by a test in the repository, so the JSON cannot silently rot:

node --test integrations/n8n/template.test.mjs

Beyond the template, any n8n instance can talk to Disputek directly - the same API key and the same three events, without the scaffold. Prefer the template if you can; write your own if you need a shape it does not cover.