WhatsApp Flows Endpoint: n8n Decryption & RSA-AES Setup

Why does dynamic WhatsApp Flow routing fail for most SMBs?

Everyone believes setting up WhatsApp Flows is just like connecting any other webhook. Here’s why that’s wrong.

WhatsApp Flows let businesses serve native, multi-screen interactive forms directly inside WhatsApp chats. Static forms work right out of the box. Interactive features need a dynamic data exchange endpoint. You’ll need one for dynamic branch selection, real-time inventory queries, and custom field validation.

Indian SMBs scale chat-driven operations alongside pipelines like WhatsApp Business Cloud API Setup for Indian SMBs: The 2026 Production Blueprint. Dynamic screens open up seamless lead intake and service booking for them.

Most deployments stall at endpoint integration. Standard webhook workflows receive plain JSON payloads. WhatsApp Flows doesn’t do that. It enforces end-to-end data exchange encryption.

Every HTTP request arrives fully encrypted. It travels from the WhatsApp client through Meta’s servers. The payload uses asymmetric RSA cryptography paired with symmetric AES-GCM data encryption.

Meta drops the interaction if your backend fails to decode the encrypted envelope. It drops it if you ignore authentication tags. It drops it if your response lags.

You don’t need expensive proprietary middleware. An n8n workflow can finish cryptographic handshakes within strict execution limits. That solves the bottleneck completely.

Step 1: Generate and Register Your 2048-bit RSA Key Pair

WhatsApp Flows endpoints rely on asymmetric key pairs. These keys secure the dynamic symmetric keys generated during each interaction.

According to Flows Encryption | Meta for Developers – Facebook, WhatsApp Flows requires a 2048-bit RSA key pair where the public key is registered with Meta by sending a POST request to the /PHONE_NUMBER_ID/whatsapp_business_encryption Graph API endpoint.

Generate your private and public keys using OpenSSL:

openssl genrsa -out flow_private_key.pem 2048

# Extract the public key in PEM format
openssl rsa -in flow_private_key.pem -pubout -out flow_public_key.pem

Store flow_private_key.pem securely. You’ll load this private key inside your n8n environment to decrypt incoming session keys.

Register the generated public key using Meta’s Graph API:

curl -X POST "https://graph.facebook.com/v21.0/{PHONE_NUMBER_ID}/whatsapp_business_encryption" \
  -H "Authorization: Bearer YOUR_SYSTEM_USER_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "business_public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...\n-----END PUBLIC KEY-----"
  }'

Step 2: Configure the n8n Webhook Endpoint

Meta requires an interactive endpoint to exchange dynamic data as users navigate between screens.

According to WhatsApp Flow Endpoint Implementation Guide – YCloud, WhatsApp Flow endpoints must be publicly accessible HTTPS endpoints that respond within 10 to 15 seconds to prevent client-side request timeout.

Create an n8n workflow starting with a Webhook node:

1. Set the HTTP Method to POST.
2. Configure Path to whatsapp-flow-endpoint.
3. Set Response Mode to Using 'Respond to Webhook' Node.

According to Implement endpoints for Flows – Meta for Developers, for Flow Data API version 3.0, the encrypted request payload sent by Meta contains encrypted_flow_data, encrypted_aes_key, and initial_vector.

Incoming payloads arrive in this structure:

{
  "encrypted_flow_data": "Base64String...",
  "encrypted_aes_key": "Base64String...",
  "initial_vector": "Base64String..."
}

Step 3: Implement RSA and AES-128-GCM Decryption in an n8n Code Node

According to Create secure interactive applications with WhatsApp flows end-to-end encryption | n8n workflow template, an n8n workflow template for WhatsApp Flows end-to-end encryption receives encrypted data via a Webhook endpoint, processes RSA and AES decryption in pipeline nodes, routes screen parameters, and encrypts responses using the decrypted AES key and an inverted IV.

According to Implement endpoints for Flows – Meta for Developers, decryption of the 128-bit AES key requires the RSA/ECB/OAEPWithSHA-256AndMGF1Padding algorithm using the private key corresponding to the registered public key.

Add a Code node downstream from your webhook. Use Node.js’s native crypto module to handle key unwrapping and AES-GCM tag verification:

const crypto = require('crypto');

const privateKeyPem = $env.FLOW_PRIVATE_KEY; // 2048-bit RSA Private Key
const { encrypted_flow_data, encrypted_aes_key, initial_vector } = $input.first().json.body;

try {
  // 1. Decrypt 128-bit AES key using RSA-OAEP SHA-256
  const decryptedAesKey = crypto.privateDecrypt(
    {
      key: privateKeyPem,
      padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
      oaepHash: 'sha256',
    },
    Buffer.from(encrypted_aes_key, 'base64')
  );

  // 2. Prepare IV and Ciphertext with Auth Tag
  const ivBuffer = Buffer.from(initial_vector, 'base64');
  const flowDataBuffer = Buffer.from(encrypted_flow_data, 'base64');

  // In GCM mode, the last 16 bytes represent the authentication tag
  const authTag = flowDataBuffer.subarray(flowDataBuffer.length - 16);
  const cipherText = flowDataBuffer.subarray(0, flowDataBuffer.length - 16);

  // 3. Decrypt the flow payload using AES-128-GCM
  const decipher = crypto.createDecipheriv('aes-128-gcm', decryptedAesKey, ivBuffer);
  decipher.setAuthTag(authTag);

  let decrypted = decipher.update(cipherText, null, 'utf8');
  decrypted += decipher.final('utf8');

  const decryptedJson = JSON.parse(decrypted);

  return [{
    json: {
      decryptedData: decryptedJson,
      aesKeyBase64: decryptedAesKey.toString('base64'),
      initialVectorBase64: initial_vector
    }
  }];
} catch (error) {
  return [{
    json: {
      error: 'DECRYPTION_FAILED',
      message: error.message
    }
  }];
}

Step 4: Handle Decryption Failures with HTTP 421

Your endpoint must handle cryptographic mismatches cleanly.

According to Implement endpoints for Flows | Meta for Developers – Facebook, if a WhatsApp Flow dynamic data exchange request cannot be decrypted by the endpoint, the server must return an HTTP 421 response status code.

Follow these steps in your n8n workflow:

1. Add an If node checking if json.error equals DECRYPTION_FAILED.
2. Connect the True branch to a Respond to Webhook node.
3. Set the Response Code to 421.
4. Leave the body empty or return a minimal JSON error message.

Step 5: Screen Logic and Payload Re-Encryption

Once decrypted, route screen requests using standard n8n nodes. You’ll handle actions like INIT, data_exchange, or BACK.

Construct your target response screen schema:

{
  "version": "3.0",
  "screen": "APPOINTMENT_SCREEN",
  "data": {
    "departments": [
      { "id": "sales", "title": "Sales Inquiry" },
      { "id": "support", "title": "Technical Support" }
    ]
  }
}

Now send this response back to the client. Encrypt it using the existing 128-bit AES key and an inverted initial vector. Invert the IV by applying a bitwise NOT operation (~byte) to each byte:

const crypto = require('crypto');

const responseData = $input.first().json.responseData;
const aesKey = Buffer.from($input.first().json.aesKeyBase64, 'base64');
const initialVector = Buffer.from($input.first().json.initialVectorBase64, 'base64');

// Invert IV bits (bitwise NOT)
const responseIv = Buffer.alloc(initialVector.length);
for (let i = 0; i < initialVector.length; i++) {
  responseIv[i] = ~initialVector[i];
}

// Encrypt response JSON with AES-128-GCM
const cipher = crypto.createCipheriv('aes-128-gcm', aesKey, responseIv);
let encrypted = cipher.update(JSON.stringify(responseData), 'utf8');
encrypted = Buffer.concat([encrypted, cipher.final()]);

// Append 16-byte authentication tag
const authTag = cipher.getAuthTag();
const finalPayload = Buffer.concat([encrypted, authTag]).toString('base64');

return [{
  json: {
    body: finalPayload
  }
}];

Route the output into a final Respond to Webhook node. Return the raw Base64 string with Content-Type: text/plain and an HTTP 200 status code.

If your team is looking to implement advanced WhatsApp automation architectures, custom CRM synchronizations, or resilient data exchange workflows, partner with LoomVector to design, deploy, and monitor scalable automation pipelines built for high-throughput enterprise messaging.