Google review text after a Square checkout

Before you start

You need an n8n account (n8n, or self-host it free) plus your own logins for: Square Appointments Twilio Gmail / Google Workspace.

How the automation flows

Tap a step to jump to its details.

Each step and what it does

1. 1⏰

   Trigger (schedule)

   Every hour

   Runs on its own every hour while the workflow is active.

   Runsevery hour

   Then → 3. Config (edit me)

2. 2⚡

   Trigger

   Incoming text

   Twilio calls this webhook every time someone texts your business number.

   Webhook pathYOUR_N8N_URL/webhook/review-sms

   Then → 3. Config (edit me)

3. 3⚙️

   Settings

   Config (edit me)

   One place for everything specific to your business. Every later step reads from here, so this is the only node you have to edit.

   Editthe settings table below

   Then → 4. Scheduled run or text?

4. 4🔀

   Decision

   Scheduled run or text?

   The schedule and Twilio share this workflow. Scheduled runs do the sending; texts (which carry a Twilio MessageSid) go through the signature check.

   Rulethe request has no Twilio MessageSid (so it's the scheduled run)

   Scheduled runs → 5. Get recent Square payments · Texts → 11. Check Twilio signature

5. 5🌐

   API call (Square)

   Get recent Square payments

   Asks Square for payments made 2 to 3 hours ago, so each client is texted about 2 hours after checkout.

   GEThttps://connect.squareup.com/v2/payments?begin_time=…&end_time=…

   🔑 Connect your Square (access token) login on this node

   Then → 6. Keep finished visits

6. 6🛡️

   Code (security check)

   Keep finished visits

   Keeps only completed payments that have a Square customer attached.

   Then → 7. Ask each client only once

7. 7🧹

   Remove repeats

   Ask each client only once

   Remembers every customer ID it has seen in earlier runs and drops repeats, so nobody gets asked twice.

   Then → 8. Get the client from Square

8. 8🌐

   API call (Square)

   Get the client from Square

   Looks up the customer's first name and mobile number in Square.

   GEThttps://connect.squareup.com/v2/customers/{customer_id}

   🔑 Connect your Square (access token) login on this node

   Then → 9. Has a mobile number?

9. 9🔀

   Decision

   Has a mobile number?

   Skips clients without a phone number on file.

   Rulethe client's mobile is filled in

   If yes → 10. Text the review link · If no → stops here

10. 10💬

    Send SMS (Twilio)

    Text the review link

    Texts your Google review link with their first name.

    Sendsthe message shown under Message copy

    🔑 Connect your Twilio login on this node

    End of this path.

11. 11🛡️

    Code (security check)

    Check Twilio signature

    Proves the request really came from Twilio. It rebuilds Twilio's signature (HMAC-SHA1 of your webhook URL plus every field Twilio sent, keyed with your auth token) and compares it to the X-Twilio-Signature header. Uses Node's built-in crypto module: fine on n8n Cloud; self-hosted n8n needs NODE_FUNCTION_ALLOW_BUILTIN=crypto.

    DetailsHow the Twilio security check works

    Then → 12. Signature valid?

12. 12🔀

    Decision

    Signature valid?

    Only real Twilio requests continue. Anything else (a bot, a fake request, a wrong URL in Config) goes to the 403 step.

    Rulethe signature Twilio sent matches the one rebuilt from your auth token

    If yes → 13. Acknowledge Twilio (text) · If no → 19. Reject: not from Twilio (403)

13. 13↩️

    Reply to request

    Acknowledge Twilio (text)

    Tells Twilio the text was received. The reply goes out separately, so this one sends nothing to the customer.

    Then → 14. Says URGENT?

14. 14🔀

    Decision

    Says URGENT?

    If the customer's text contains the word URGENT (any capitalization), the urgent path runs instead of the normal reply.

    Ruletheir text contains “urgent”

    If yes → 15. Text the owner (URGENT) · If no → 18. Forward the reply to you

15. 15💬

    Send SMS (Twilio)

    Text the owner (URGENT)

    Texts your cell right away with their number and exactly what they wrote.

    Sendsthe message shown under Message copy

    🔑 Connect your Twilio login on this node

    Then → 16. Text the customer (URGENT ack)

16. 16💬

    Send SMS (Twilio)

    Text the customer (URGENT ack)

    Lets the customer know their message reached you.

    Sendsthe message shown under Message copy

    🔑 Connect your Twilio login on this node

    Then → 17. Email the owner (URGENT, optional)

17. 17✉️

    Send email (Gmail)

    Email the owner (URGENT, optional)

    A copy by email. If Gmail isn't connected or fails, the workflow still finishes (the text already went out).

    Sendsthe message shown under Message copy

    🔑 Connect your Gmail login on this node

    End of this path.

18. 18✉️

    Send email (Gmail)

    Forward the reply to you

    Emails you what they wrote, so you can answer from your phone.

    Sendsthe message shown under Message copy

    🔑 Connect your Gmail login on this node

    End of this path.

19. 19↩️

    Reply to request

    Reject: not from Twilio (403)

    Answers 403 Forbidden and stops. Nothing is texted, emailed or saved.

    Responds403 Forbidden

    End of this path.

Key settings to change

All of these live in the Config (edit me) node. Change them once and every text and email updates.

Message copy: exactly what it sends

Highlighted parts are filled in automatically. Edit the wording right in the node.

How the Twilio security check works

Your webhook URL is public, so anyone who finds it could send fake "texts" and make the workflow text people on your dime. Every request Twilio sends is signed, so the first thing this workflow does is check that signature:

1. Take the exact webhook URL from Config (twilio_sms_webhook_url, or twilio_voice_webhook_url for call events).
2. Sort every field Twilio posted by name and glue each name and value onto the end of the URL (…BodyhiFrom+1555…).
3. HMAC-SHA1 that string with your Twilio auth token, base64-encode it, and compare it to the X-Twilio-Signature header (a constant-time compare).
4. Match: continue. No match, no header, or no URL/token in Config: answer 403 Forbidden and stop.

It's a Code node because n8n's Crypto node can't do HMAC-SHA1. It uses Node's built-in crypto module: allowed on n8n Cloud. Self-hosted n8n: set the environment variable NODE_FUNCTION_ALLOW_BUILTIN=crypto (on your task runners too, if you use them), or the node errors.

The auth token lives only in Config. Never paste it into the code, and don't share your workflow export once it's filled in.

Hook it up

Test it before you trust it

• Fill in every setting in Config (edit me), including your Twilio auth token, and connect your logins on the nodes with a red warning.
• Point Twilio Messaging at the Production URL (…/webhook/review-sms), then activate the workflow.
• Security test 1 (fake request is rejected): run curl -i -X POST https://YOUR-N8N-URL/webhook/review-sms -H 'X-Twilio-Signature: bad' --data-urlencode From=+15555550123 -d Body=hi -d MessageSid=SMtest. You should get 403 and nothing should be texted or emailed.
• Security test 2 (real text gets through): text your Twilio number from your phone. The execution should go through Signature valid? on the yes side. If real texts get a 403, the URL in twilio_sms_webhook_url doesn't exactly match the one in Twilio (check https, trailing slashes and …/webhook/ vs …/webhook-test/) or the auth token is wrong.
• Optional: make a valid signature yourself and expect a 200: printf '%s' 'https://YOUR-N8N-URL/webhook/review-smsBodyhiFrom+15555550123MessageSidSMtest' | openssl dgst -sha1 -hmac 'YOUR_AUTH_TOKEN' -binary | base64, then send the same curl with that value as X-Twilio-Signature. (Fields sorted by name, name+value, appended to the exact URL. The reply to the fake number will fail; that's expected.)
• URGENT test: from another phone, text this is urgent. Your cell (owner_cell) should get the URGENT text within seconds, the sender should get the acknowledgement, and no normal reply should go out.
• Text something normal (no URGENT). You should get it by email.
• Ring up a small test payment in Square attached to a customer with your mobile number. About 2-3 hours later the hourly run should text you the review link (or execute the workflow manually during that window).
• Next hour: no second text, because Ask each client only once remembers you.
• Open Executions in n8n. Every run should be green. A red node tells you exactly which step to fix.
• Texts not arriving? The usual cause is A2P 10DLC registration still pending in Twilio.