Seeking Advice on Automating Client Connections with OAuth2 in n8n

[draakzy]

Hello there,

I’m posting on the forum because I work for a company and we’re searching for the right automation service.

To briefly explain what we do and what we’re looking for:

We generate videos for clients and then post them on their social media accounts (YouTube, Instagram for Business, Facebook Pages, LinkedIn).

Problem: We currently connect our clients manually in our workflows, which is no longer sustainable given the number of clients we have.

We’re looking for a way to automatically connect each of our clients. We’re considering using the OAuth2 protocol but we’re unsure if this is possible and if n8n could be the right fit for this.

We currently use Zapier and Make, but we could easily migrate all our clients if the platform meets our needs.

Thank you in advance for your feedback and suggestions. I hope we can find a solution quickly.

Have a great weekend, everyone!

Draakzy

[n8n]

It looks like your topic is missing some important information. Could you provide the following if applicable.

• n8n version:
• Database (default: SQLite):
• n8n EXECUTIONS_PROCESS setting (default: own, main):
• Running n8n via (Docker, npm, n8n cloud, desktop app):
• Operating system:

[ThinkBot]

I believe, you can find the solution to your answer here. I asked the same thing for another client. Let me know if you need any setup help.

Thread:

Does n8n offer any “customer facing connection portal”?

What I mean by this, is there are a few automation services designed with the idea that you create a workflow & a customer connection portal with settings. I’m building for a client at the moment with useparagon.com. They are looking at integration.app as an alternative due to paragon’s excessive jank. The portal essentially deploys our designed workflow for each customer who connects to the portal. Ie we are using hubspot. $500/m is a steep price for a jank product with just 1 feature my cli…

Answer:

Does n8n offer any “customer facing connection portal”?

Hi @ThinkBot, thanks for reaching out and being a part of the community! That sounds like you’re looking at n8n to serve as an embedded iPaaS. We do offer the ability to embed n8n within your product. If you do not want to fully embed the n8n interface in your application, there is the ability to create new credentials through n8n’s API. I could imagine a scenario where you could build a simple application layer where users could create credentials through a series of required form fields that…

Justin - thinkbot.agency

[hndmn]

I am currently in the same predicament and would be happy to work on this with anyone interested. Through this and the related question I’m now looking at the iPaaS category. I’m trying to figure out how to support user-managed OAuth2 credentials without storing any secrets in my app’s database.

[Jon]

The best start would be to get in touch with our sales team about the embed license which is often needed if you are using “customer” credentials in n8n before you go too far down this path. It could be that you don’t need the license but if you do then you would need to budget for that, They may also be able to share how other embed customers do it.

I know that some users have implemented Nango as a solution to get the credentials to use but I don’t have a guide on how to do that.

[hndmn]

Thank you @Jon - it’s encouraging to hear about Nango. I discovered them separately and am investigating that option. I’ll report back with how that goes. I’ll also consider the embed option.

[Jon]

Hey @hndmn,

Sounds good to me, It may be worth checking our license before you get too involved to see if you may need it as we are not “open source” so some commercial / non internal business use cases that normally involve users credentials from outside of n8n require a license.

Faircode license | n8n Docs

[hndmn]

UPDATE: Nango is looking promising here. If you use it for auth only (which is free), your users can authorize their services in your frontend via oauth, api keys or basic auth. Your app can then get and send the related tokens to n8n via webhooks. From there, you may not even need a credential as you can use the HTTP Request node and it’s expressions to dynamically query an API. Or you could query the data and then send it into n8n for processing to not transmit auth tokens. Anyways, it seems like this might be a viable service for handling the original question of this thread.

[Turn.One]

Curious to see how this develops. I have a couple of clients that want me to build more and more workflows that mainly need a lot of Google account credentials. I also want to build more of an application backend on n8n in the near future that users can sign up to, fill in some variables and get hooked up to a new, corresponding workflow.

[hndmn]

Here’s where I’m at so far:

1. Users register and sign in to my app
2. Inside Nango (and in the 3rd party services) I configure integrations
   
3. My app uses Nango’s SDKs to generate a list of available integrations and enables users to create and delete connections
   
4. Users are prompted to authorize the app, which is slightly different for each service. This creates a ‘Connection’ in Nango
   
   
5. My app then polls Nango for any connections, which include the tokens and URLs necessary to make an API call via the HTTP Request node. They look like:

{
    "id": 18393,                                 
    "created_at": "2023-03-08T09:43:03.725Z",     
    "updated_at": "2023-03-08T09:43:03.725Z",     
    "provider_config_key": "github",              
    "connection_id": "1",                         
    "credentials": {
        "type": "OAUTH2",                         
        "access_token": "gho_tsXLG73f....",       
        "refresh_token": "gho_fjofu84u9....",     
        "expires_at": "2024-03-08T09:43:03.725Z", 
        "raw": { // Raw token response from the OAuth provider: Contents vary!
            "access_token": "gho_tsXLG73f....",
            "refresh_token": "gho_fjofu84u9....",
            "token_type": "bearer",
            "scope": "public_repo,user"
        }
    },

6. My app sends webhooks to n8n that contain the connection and any data I want to process in my workflows.

My understanding is that Nango will keep the tokens alive by refreshing them so long as I query them often enough, so the user authorizes just once and only reconnects if credentials change. I also haven’t yet dug into webhook security and reliability for passing credentials, but will do. It’s coming together and I haven’t yet hit a wall that will prevent this from working…

[Jon]

Just don’t forget that there is a good chance this could be in the grey area of our licensing so it would be worth finding out if you need a license for your usage.

[Turn.One]

How is N8N helping with these things and then also helping them set up potential license agreements? I think things like this address a need from the market and could help to drive both growth and revenue for N8N.

[hndmn]

Just to close the loop on this from my perspective: I spoke with the n8n team and something like this does fall under the embed license, which starts at 50,000 euros per year. So long as there is customer data being handled on your server (self-hosted or cloud), the fair use license doesn’t apply. So while the solution is technically possible using n8n and a service like nango, it is economically impossible for an unfunded startup or hobby. I wish there were something in the middle that could scale up with usage. As-is, this means I can’t use n8n for my business and I have to look elsewhere, which is disappointing, but I will respect the decision.

[Andrew_Luetgers]

Same boat, trying to build a startup that supports integrations with Nango and workflows that use them in n8n but I think I will have to build something in xyflow on top of Temporal as my plan-b at this point, which is fine, just not what I hoped for.

[hndmn]

Thanks for this - I wasn’t aware of that option and will investigate it. I was resigned to falling back to using Make. And I should clarify that I can use n8n for my business, just not this portion of it. Though, realistically, I won’t have two separate automation systems running.