SPEC.00 / Technical specification

How the machine works.

Three subsystems — registration, signing, access control — explained at the protocol level.

SPEC.01 / Registration

Register any HTTP webhook as a tool

Copy your n8n webhook URL, paste it into AutoHub, set a credit cost, and you have a tool. Supports POST with JSON body. Any automation platform that can receive HTTP POST works.

REQUEST

POST /api/tools

name: "Send Slack Alert"

webhookUrl: "https://n8n.example.com/webhook/…"

creditCost: 2

executionMode: "sync"

SIGNATURE

# Headers on every callback

X-AutoHub-Timestamp: 1714000000

X-AutoHub-Signature: sha256=a3f…

# Verify in n8n

HMAC-SHA256(secret,

"timestamp.executionId.body")

SPEC.02 / Signing

Industry-standard HMAC signing

Each tool gets a unique signing secret. Executions and callbacks are verified with HMAC-SHA256 and a ±300s timestamp window — the same pattern used by Stripe, GitHub, and Shopify webhooks.

SPEC.03 / Access control

Three-tier access model

USERRuns approved tools, manages credit wallet

MODERATORCreates tools, sets visibility, grants private access

ADMINApproves tools, governs users, infinite credits

VISIBILITY MATRIX

Public tools

Private (owner only)

Private (granted users)

Launch sequence ready

Ready to automate?

Start free. 10 credits included. No credit card required.

Initiate free →