The Wait Node Is the Easy Part: 6 Ways an n8n Human-Approval Step Breaks (and the .NET Fixes)

Description and use

The article details fixes for six common failures in n8n human‑approval steps, employing a .NET API to verify HMAC signatures, timestamps, idempotency keys, and a state machine.

Problem

Human approval steps in n8n workflows often fail due to signature mismatches, replay attacks, duplicate drafts, conflicting decisions, and retry logic.

Outcome

All six failure modes were addressed, yielding a robust human‑approval workflow with 32 passing tests and idempotent, secure draft handling.

Workflow

• 1. n8n creates draft JSON and signs raw string. 2. Sends POST to .NET API with raw body. 3. API verifies signature against raw bytes and timestamp. 4. API stores draft with idempotency key. 5. Human reviews via webhook, posts decision. 6. API updates draft state using state machine rules.
• 7. n8n resumes workflow based on final state.

Evidence

The first thing you do is sign the request with HMAC so only your n8n can submit drafts.

Source

The fix: build the JSON string once in a Code node, sign that exact string, and send it as a raw body.

Source

sign the timestamp together with the body, as "{unixSeconds}.{rawBody}"

Source

an idempotency key that n8n can compute the same way on every retry.

Source

A draft can only leave <code>pending</code>, and only once.

Source