Countdown timers in n8n

Header Auth credential

Credentials -> New -> Header Auth

  Name:  CountdownShare
  Name:  Authorization
  Value: Bearer cs_live_your_key_here

Using a credential rather than a hardcoded header keeps the key
out of the workflow JSON — which matters as soon as you export
a workflow or commit it to version control.

HTTP Request node

HTTP Request node — "Create countdown"

  Method:         POST
  URL:            https://countdownshare.com/api/v1/timers
  Authentication: Generic -> Header Auth -> CountdownShare

  Headers:
    Idempotency-Key   {{ "trial_" + $json.customer_id }}

  Body (JSON):
  {
    "name": "Trial — {{ $json.email }}",
    "type": "personalized",
    "duration_seconds": 1209600,
    "external_user_id": "{{ $json.customer_id }}",
    "publish": true
  }

HTTP Request node

HTTP Request node — "Notify me when it ends"

  Method: POST
  URL:    https://countdownshare.com/api/v1/timers/{{ $json.data.id }}/webhook-rules

  Body (JSON):
  {
    "name": "Trial ended",
    "webhook_destination_id": "{{ $env.CDS_DESTINATION_ID }}",
    "condition": {
      "field": "status",
      "operator": "equals",
      "value": "ended"
    },
    "delivery": "once"
  }

Register the destination once, by hand, pointing at your n8n
Webhook trigger URL. Reuse its ID across every workflow.

Code node — verify before acting

// Code node, immediately after the Webhook trigger.
// Set the Webhook node's "Raw Body" option to ON, or the
// signature can never be verified.
const crypto = require('crypto');

const secret = $env.CDS_WEBHOOK_SECRET;
const raw = $input.first().binary
  ? Buffer.from($input.first().binary.data.data, 'base64').toString()
  : $input.first().json.body;

const headers = $input.first().json.headers;
const timestamp = headers['x-countdownshare-timestamp'];
const signature = headers['x-countdownshare-signature'];

if (!timestamp || !signature) {
  throw new Error('Unsigned delivery');
}

if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
  throw new Error('Stale delivery');
}

const expected = crypto
  .createHmac('sha256', secret)
  .update(`${timestamp}.${raw}`)
  .digest('hex');

const a = Buffer.from(expected, 'hex');
const b = Buffer.from(signature.replace(/^v1=/, ''), 'hex');

if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
  throw new Error('Invalid signature');
}

return [{ json: JSON.parse(raw) }];