GitHub

GitHub signs webhook bodies with HMAC-SHA256 in X-Hub-Signature-256, hex-encoded and prefixed with sha256=. You connect it with the GitHub preset, which uses Generic HMAC SHA-256. This mode has no replay protection, because the signature covers the body only and carries no timestamp.

Provider docs: Setting up webhooks in GitHub

Setup

1. Connect It in Wexio

Go to New connection → Inbound. Under Provider presets, click the GitHub chip in HMAC presets. It sets Authentication mode to Generic HMAC SHA-256 and fills in these fields. Check that they match.

Field	Value
Signature header name	`X-Hub-Signature-256`
Encoding	`Hex`
Header prefix (optional)	`sha256=`

Copy the Wexio endpoint URL. You paste the secret into Signing secret after the next step.

2. Set Up the Provider

On the GitHub repository (or organisation), go to Settings → Webhooks → Add webhook.

Field	Value
Payload URL	The Wexio endpoint URL
Content type	`application/json`
Secret	A strong secret you pick. Paste the same value into the Wexio Signing secret field
Events	Individual events, or "Send me everything"

3. Resolve Contacts

GitHub events are usually not tied to messaging contacts. Two patterns work.

Team contact. Send the event through a proxy that adds the chat ID of a team contact to the body, then set Contact identifier type to Chat ID.
Author email. Use Email with $.sender.email. This works only when the user's email is public in their GitHub profile, and that person is a contact in Wexio.

4. Bind a Flow

Add a Webhook Received trigger and branch on {{webhook.action}}.

GitHub puts the event type in the X-GitHub-Event header, not the body. To branch on it, capture the header through a custom upstream such as an n8n proxy. Or use the action field in the body, which most events carry.

Example - PR Merged to Team Chat

GitHub event: pull_request with action closed and merged: true
Wexio connection: a proxy adds the chat ID of a shared team contact, and the identifier type is Chat ID
Flow: Webhook Received, Condition on {{webhook.pull_request.merged}} EQUALS true, then a text to a shared Telegram channel

Troubleshooting

Symptom	Fix
Signature mismatch	Make sure the secret is exactly the same string in GitHub and Wexio
`IDENTIFIER_NOT_FOUND`	GitHub events rarely carry a Wexio contact identifier. Use the team contact pattern above

Inbound Webhooks - auth modes, contact resolution and response codes
Custom HMAC - how Generic HMAC SHA-256 verifies a request
Webhook Received - the trigger that starts your flow
Webhook History - check why a request failed

GitHub

On this page