Send Yirlo replies and hot leads to n8n

What Yirlo sends to your n8n workflow

Two event types exist. reply.received goes out when a lead responds with an actual reply. Auto-responders about being away, unsubscribe requests and bare refusals stay silent. hot_lead.received goes out when Yirlo considers a reply to show genuine interest.

Every notification lands in your n8n workflow as a single POST request with a JSON payload. The payload has three top-level keys: event, occurred_at (an ISO-formatted time) and data. The data key nests the lead's email, first_name, last_name and company, along with the campaign name and the reply. The reply text is shortened to its first 3,000 characters.

Each request is signed, so you can check where it came from. Look for the X-Yirlo-Signature header. Its value is a hash of the unmodified request body, computed with HMAC-SHA256 and the secret of the webhook that fired. That secret starts with whsec_ and is shown next to the webhook in the app.

Create the Webhook node and add its URL to Yirlo

In n8n, create a new workflow and add a Webhook node as the trigger. Set the HTTP method to POST and choose a path you will recognize later, such as yirlo-replies. Leave the response mode on its default so n8n answers immediately.

The node shows two URLs: a Test URL and a Production URL. The Test URL only works while you are listening for a test event in the editor. The Production URL works once the workflow is active. Use the Test URL while you build, then switch to the Production URL.

Register your n8n address under Integrations, inside Settings in Yirlo. Only https URLs are accepted, so an n8n instance you host yourself must sit behind a valid TLS certificate. Up to 20 endpoints are allowed, which is handy for sending identical events to both a live workflow and a test one.

Copy the whsec_ secret for that webhook. You will need it in the verification step.

Verify the signature in n8n

The signature is computed over the exact bytes of the body. If n8n parses the JSON and you serialize it again, whitespace or key order can change and the hashes will not match. To avoid that, open the Webhook node's Options, add Raw Body, and turn it on. n8n then keeps the original body as binary data.

Next, add a node that converts the binary data to text. Extract From File with the text operation does this, and it puts the body string into a field you name, for example rawText. Then add a Crypto node. Set the action to Hmac, the type to SHA256, the value to the rawText field, and the secret to your whsec_ value. Name the output property computedSignature.

Finish with an If node. Compare computedSignature to the incoming header using an expression such as {{ $('Webhook').item.json.headers['x-yirlo-signature'] }}. n8n lowercases header names, so use the lowercase form. Send the true branch on to the rest of your workflow. On the false branch, connect a Stop and Error node so a forged or corrupted request goes nowhere.

The Crypto node lets you choose the output encoding. On your first test delivery, look at the header value in the Webhook node output and pick the encoding that matches how it looks. If the comparison fails on a genuine request, the encoding is the first thing to check, followed by whether Raw Body is actually on.

Keep the secret out of shared screenshots and exported workflow files. Store it in an n8n credential or variable if your plan supports that, so it is not pasted into every node that needs it.

Parse the body and route by event

Once the signature passes, turn the text back into fields. An Edit Fields node with an expression like {{ JSON.parse($('Extract From File').item.json.rawText) }} gives you the event, occurred_at and data values to work with. Adjust the node name in the expression to match the one in your workflow.

Add a Switch node on the event value. One output handles reply.received and another handles hot_lead.received. This keeps the two paths separate, so a routine reply can be logged quietly while a hot lead triggers something louder.

Because occurred_at is part of the signed body, you can also reject anything older than a few minutes with an If node. This is optional, but it stops someone from replaying an old captured request against your URL.

Workflows worth building with replies and hot leads

Yirlo already emails interested replies to you as hot leads and lets you read the full inbox in the app. A workflow in n8n adds the routing that suits your own team, in the tools you already run.

Contacts can land in your CRM of choice, such as HubSpot, Salesforce or Pipedrive. Add that system's own n8n node after the Webhook trigger and map the fields from the data object.

• Post hot leads to a Slack or Teams channel with the lead's name, company, campaign and the full reply text, so whoever owns follow-up sees it within seconds.
• Append every reply.received event to a Google Sheets or Airtable table, with the campaign name in a column, to compare which campaigns draw real conversations.
• Create a task or a card in your project tool for each hot lead, assigned to a person by campaign.
• Send a text notification through a service you already use when a hot lead arrives outside working hours.
• Write each lead into the database or CRM you run, using email and company as the match keys.

Keep the workflow inside the five-second timeout

Your n8n webhook has a five-second window to acknowledge each call from Yirlo, and after that the delivery attempt is abandoned. The Webhook node's default option sends its response the moment the workflow begins, so later steps are free to run as long as they like. Leave it on that default, and avoid the option that holds the response until the final node finishes.

Slow steps such as writing to several tools, waiting on an API or sending a long message all happen after the response has gone back. If you want the heavy work isolated, end the verification branch with a call to a second workflow and let that one do the rest.

Troubleshooting with the last delivery status

Yirlo records whether the latest delivery to each webhook succeeded, and the app displays it. That tells you fast if n8n responded. Look there first if your executions list stays empty.

If the status shows a failure, confirm that the workflow is active and that you pasted the Production URL, not the Test URL. A Test URL stops working the moment you leave the listening state in the editor. Also confirm the URL starts with https and that the path matches the one on the Webhook node.

If deliveries succeed but the If node keeps sending requests to the error branch, recheck three things: Raw Body is switched on, the secret in the Crypto node is the one for this particular webhook, and the encoding matches the header.

Questions

Related