Signature in Resume Url of wait node

Questions
1

previously, the resume url of wait node was in that format …/webhook-waiting/[Execution ID]
but at some point it became …/webhook-waiting/[Execution ID]?signature=[HMAC Hex].
and when i hit the resume url without signature, it gives 401 unauthorized.
my question is what happened that could change it like that? is there a way to disable it?

2

Hey @Mohamed8, while you wait for a response, here are some things that might help:

Suggested resources

Automatically matched to your question.

Docs:

Forum:

@dmo1innovate, @ramin1 - you’ve helped with similar issues before, can you take a look?

Automatically suggested by n8n’s community bot. It’s a pilot - please share feedback here.

3

The signature parameter was added as a security patch to prevent unauthorized or brute-forced execution resumes. In older n8n versions, because execution IDs are sequential or predictable integers, anyone could hit /webhook-waiting/[Execution ID] to arbitrarily resume or manipulate pending Wait node executions. The ?signature= query parameter is an HMAC token generated using your N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS / instance secret key, verifying that only authorized callers holding the signed URL can trigger the wait resume.

If you upgraded n8n, the Wait node behaviour may have changed automatically.

No officially supported way exists. The signature is baked into the resume URL generation internally.

4

@kjooleng thanks, but i have tried adding N8N_WAIT_NODE_WEBHOOK_URL_WITHOUT_SIGNATURE=true

but nothing happened. still the same issue it generates it with signature

5

Sorry, my mistake.

Your practical options are:

  1. Always use $execution.resumeUrl dynamically — never cache or pre-compute the resume URL outside the execution context. The variable already includes the correct ?signature= value at runtime .

  2. Use the Authentication field on the Wait node (Basic Auth, Header Auth, JWT Auth) if you need caller-side auth control — this is orthogonal to the signature, which is server-side validation .

  3. If you need signature-free URLs for a specific integration, the only workaround is to proxy the call through a regular Webhook node that calls the resume URL internally, but that adds unnecessary complexity.

  4. Check your n8n version changelog — if this broke a specific workflow, the exact version where signature was introduced can be pinpointed by diffing the packages/cli/src/WaitTracker.ts or WebhookHelpers.ts in the n8n GitHub repo, which would confirm whether a feature flag exists in that version.

6

hi @Mohamed8, good morning!

That variable is not recognized by current versions of n8n, so it’s ignored and the URL continues to be generated with signature. At the moment, the signature is part of the mandatory security mechanism of the Wait node and there’s no official supported configuration to remove it; you need to use the complete URL from $execution.resumeUrl

7

Hi @Mohamed8
If what you need is a callback URL the caller can build for itself, take the resume out of the Wait node. Finish the first workflow after writing a correlation ID of your own to a table, and have the external system call a plain Webhook node in a second workflow, on a fixed path you control, with Header Auth on the node and the correlation ID in the body. That path stays the same across executions and has no query string to lose, and the second workflow picks the record back up by the ID.