` header.
A token is bound to the webhook trigger it was issued for. A token issued for another trigger, or for the instance's MCP server, receives a 401 response.
### Respond
* **Immediately**: The Webhook node returns the response code and the message **Workflow got started**.
* **When Last Node Finishes**: The Webhook node returns the response code and the data output from the last node executed in the workflow.
* **Using 'Respond to Webhook' Node**: The Webhook node responds as defined in the [Respond to Webhook](/integrations/builtin/core-nodes/n8n-nodes-base.respondtowebhook.md) node.
* **Streaming response**: Enables real-time data streaming back to the user as the workflow processes. Requires nodes with streaming support in the workflow (for example, the [AI agent](/integrations/builtin/cluster-nodes/root-nodes/n8n-nodes-langchain.agent.md) node).
### Response Code
Customize the [HTTP response code](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status) that the Webhook node returns upon successful execution. Select from common response codes or create a custom code.
### Response Data
Choose what data to include in the response body:
* **All Entries**: The Webhook returns all the entries of the last node in an array.
* **First Entry JSON**: The Webhook returns the JSON data of the first entry of the last node in a JSON object.
* **First Entry Binary**: The Webhook returns the binary data of the first entry of the last node in a binary file.
* **No Response Body**: The Webhook returns without a body.
Applies only to **Respond > When Last Node Finishes**.
## Node options
Select **Add Option** to view more configuration options. The available options depend on your node parameters. Refer to the table for option availability.
* **Allowed Origins (CORS)**: Set the permitted cross-origin domains. Enter a comma-separated list of URLs allowed for cross-origin non-preflight requests. Use `*` (default) to allow all origins.
* **Binary Property**: Enabling this setting allows the Webhook node to receive binary data, such as an image or audio file. Enter the name of the binary property to write the data of the received file to.
* **Ignore Bots**: Ignore requests from bots like link previewers and web crawlers.
* **IP(s) Allowlist**: Enable this to limit who (or what) can invoke a Webhook trigger URL. Enter a comma-separated list of allowed IP addresses. Access from IP addresses outside the allowlist throws a 403 error. If left blank, all IP addresses can invoke the webhook trigger URL.
* **No Response Body**: Enable this to prevent n8n sending a body with the response.
* **OAuth2 Client**: How n8n handles a request without a bearer token when **Authentication** is **n8n User Auth (OAuth2)**. **Auto-Detect** (default) redirects browser navigations through the n8n sign-in page and requires a bearer token from everything else. **Bearer Token Only** always requires a bearer token and never redirects. **Browser (Virtual Client)** always redirects GET requests without a bearer token through the n8n sign-in page. Only GET requests can be redirected. Webhook nodes with a version below 2.2 keep the **Bearer Token Only** behavior until you set this option.
* **Only Run If**: An expression evaluated against the incoming request. The workflow only runs if the expression returns `true`. Use `$json` to access the request as `{ body, headers, params, query }`. For example, `{{ $json.body.campaign_id === 'user-research-invite' }}`. Requests that don't match receive a 200 response without creating an execution. If the expression fails to evaluate, n8n logs a warning and lets the request through rather than blocking it. This runs after IP allowlist and authentication checks, and applies to both test and production webhook URLs.
* **Raw Body**: Specify that the Webhook node will receive data in a raw format, such as JSON or XML.
* **Response Content-Type**: Choose the format for the webhook body.
* **Response Data**: Send custom data with the response.
* **Response Headers**: Send extra headers in the Webhook response. Refer to [MDN Web Docs | Response header](https://developer.mozilla.org/en-US/docs/Glossary/Response_header) to learn more about response headers.
* **Property Name**: by default, n8n returns all available data. You can choose to return a specific JSON key, so that n8n returns the value.
| Option | Required node configuration |
| ---------------------- | ------------------------------------------------------------------------------------- |
| Allowed Origins (CORS) | Any |
| Binary Property | Either:
HTTP Method > POST
HTTP Method > PATCH
HTTP Method > PUT
|
| Ignore Bots | Any |
| IP(s) Allowlist | Any |
| Only Run If | Any |
| Property Name | Both:
Respond > When Last Node Finishes
Response Data > First Entry JSON
|
| No Response Body | Respond > Immediately |
| OAuth2 Client | Authentication > n8n User Auth (OAuth2) |
| Raw Body | Any |
| Response Code | Any except Respond > Using 'Respond to Webhook' Node |
| Response Content-Type | Both:
Respond > When Last Node Finishes
Response Data > First Entry JSON
|
| Response Data | Respond > Immediately |
| Response Headers | Any |
## How n8n secures HTML responses
{% hint style="info" %}
**Feature availability**
Automatic wrapping of HTML responses to webhooks in `