azure-logic-apps-webhooks

Azure Logic Apps Webhooks

Covers outbound calls from the built-in HTTP action (and HTTP trigger) in Azure Logic Apps, Consumption or Standard, and the equivalent HTTP action in Power Automate. Your endpoint is the destination; the workflow decides the method, headers and body.

Not covered: the Logic Apps Request trigger (that's the workflow receiving calls, secured with SAS sig parameters or Entra ID policies), and the HTTP Webhook action's subscribe/callback protocol.

When to Use This Skill

• How do I receive a webhook from an Azure Logic App?
• How do I verify a Logic Apps HTTP action call? (There is no signature.)
• How do I check Basic authentication from Logic Apps in Express, Next.js or FastAPI?
• How do I use a shared secret header or Raw authentication with Logic Apps?
• Why does my Logic App get 401 from my webhook endpoint?
• Why does my Logic App keep polling my endpoint after I return 202?

Verification (core)

Logic Apps does not sign webhook payloads: no HMAC, no signature header, no timestamp. You authenticate the request with a credential configured on the HTTP action, and compare it in constant time:

const crypto = require('crypto');
// Hash first: equal-length buffers, no length leak, timingSafeEqual never throws.
const safeEqual = (a, b) => crypto.timingSafeEqual(
  crypto.createHash('sha256').update(String(a)).digest(),
  crypto.createHash('sha256').update(String(b)).digest());

function verifyBasicAuth(authorization, username, password) {
  const m = /^Basic\s+([A-Za-z0-9+/=]+)\s*$/i.exec(authorization || '');
  if (!m) return false;
  const decoded = Buffer.from(m[1], 'base64').toString('utf8');
  const sep = decoded.indexOf(':');            // first colon: passwords may contain ':'
  if (sep === -1) return false;
  const userOk = safeEqual(decoded.slice(0, sep), username);
  const passOk = safeEqual(decoded.slice(sep + 1), password);
  return userOk && passOk;                     // evaluate both, then combine
}

// Shared secret in a header (for Raw auth, the header is Authorization)
const verifySharedSecret = (value, secret) => Boolean(value && secret) && safeEqual(value, secret);