n8n Google Cloud TTS Safe

Minimal n8n community node that calls Google Cloud Text-to-Speech with an
existing built-in Google Service Account API (googleApi) credential.

It exists to work around malformed/escaped PEM handling in an HTTP Request
credential path while keeping the private key inside n8n's credential store.
The node:

• normalizes the service-account PEM in memory;
• creates a short-lived OAuth assertion with Node.js crypto;
• requests an OAuth access token without exposing either token or key;
• calls texttospeech.googleapis.com/v1/text:synthesize;
• validates that returned audio is MP3;
• preserves the input JSON and writes audio to binary.data by default.

Example configuration

• Credential: select an existing n8n Google Service Account API credential
• Language: vi-VN
• Voice: vi-VN-Chirp3-HD-Aoede
• Speaking rate: 1.05
• Pitch override: disabled for Chirp 3 HD compatibility
• Text: ={{ $json.voiceover_request_text }}
• Binary property: data
• File ID: ={{ $json.safe_id || $json.content_id || 'voiceover' }}

Safety properties

• No credential is created or modified.
• No private key, JWT, or OAuth token is returned in node output.
• No files are written by this node.
• The node does not alter workflow state or call publishers.
• OAuth tokens are kept only in local variables for the current execution.
• Pitch is sent only when explicitly enabled; the target Chirp 3 HD voice uses
  its natural pitch by default.

Local verification

Run npm run check and npm test. Tests use a temporary RSA key generated in
memory and mocked HTTP responses; they do not connect to Google or n8n.

Do not install this package into a running n8n instance until its package,
backup, restart, and rollback procedure have been reviewed for that server.