Passing webhook data to an AI step safely

Send an AI step only the fields it needs, and treat every word in them as untrusted. Keep passwords, API keys, card numbers and customer records out of the prompt unless your business's own policy allows them.

What you need

• A saved sample of the webhook message, so you know every field it can hold. Reading a sample is covered in this walkthrough.
• Your business's policy on what can go into AI tools. If you don't have one, ask whoever handles privacy for the business.
• A clear idea of what the AI step is for. "Sort this enquiry into a category" is a good job. "Handle everything" isn't.

What should go in

Only the fields the step needs for its job. If the task is to label an enquiry as a booking question or a complaint, it needs the message text. It doesn't need the sender's phone number, address or account details.

Zapier splits webhook data into separate fields, which lets you pick the ones you use in later steps.¹ Its Pick Off A Child Key setting is useful if you only need a subset of the data sent to the webhook.¹

Choose on purpose. Don't drop the whole payload into the prompt just because that's the quickest way to get the step working on a busy afternoon, since the extra fields come along too.

What should stay out

Less is better here. Every extra field is one more thing you'd have to explain if something went wrong. The list below is the minimum to keep out.

• Passwords and API keys. These can sit in headers or in the body of some messages. Strip them before anything is passed on.
• Card numbers and payment details.
• Customer records, such as full names with addresses, health details or account numbers, unless your own policy says they can go to that AI tool.
• Anything you wouldn't want a stranger to read.

Whether a tool keeps or uses what you send depends on its maker and your plan. Read the maker's own documentation and your own policy. Privacy laws differ by country, so use your national regulator's official guidance for the legal side.

Check the message before the AI step sees it

Not every webhook is meant for your AI step. GitHub's advice is to check the event type and action before processing a payload.² You can apply the same idea to any sender.

n8n has a node option called Only Run If. The workflow only runs if the expression you write returns true.³ But if the expression fails to evaluate, n8n logs a warning and lets the request through instead of blocking it.³ Requests that don't match get a 200 reply without starting a run, and the check happens after the IP allowlist and authentication checks.³ Test your expression with a sample message before you rely on it. n8n also lets you require authentication from any service calling your URL.³

In plain terms, drop messages from the wrong event. Then use the sender's checks, so a stranger can't push text into your workflow.

Treat the text as untrusted

A webhook can carry words typed by someone outside your business, such as a form message. If that text goes into a prompt, the AI may read it as instructions.

OWASP calls this indirect prompt injection. It happens when a model accepts input from external sources such as websites or files.⁴ A form field isn't named there, but it's the same kind of outside text.

OWASP says it's unclear whether foolproof methods of prevention exist.⁴ So reduce the damage instead.

• Mark the incoming text as data. OWASP suggests separating and clearly denoting untrusted content to limit its influence.⁴
• Give the AI step a narrow job and no extra powers. Don't let it send emails, change records or issue refunds by itself.
• Put a person in front of risky actions. OWASP recommends human-in-the-loop controls for privileged operations.⁴
• Read a few outputs now and then to see what the step is doing with real messages.

A short checklist before you switch it on

• List every field in the message. Mark each one "needed" or "not needed".
• Remove secrets, card details and anything your policy bars.
• Filter by event type and sender.
• Label the incoming text as data in the prompt.
• Keep the AI step's reach small, with a person approving anything risky.
• Keep the webhook URL private. See the webhook URL page.

For how each tool builds the earlier steps, see webhook steps in automation tools.