n8n-nodes-premely

Official n8n community node for verifying signed events delivered by
Premely Analytics.

The node verifies the v1 HMAC-SHA256 signature over the exact raw webhook body, checks the
Premely delivery headers against the signed envelope, and only then exposes the canonical event
to later workflow steps. It has no runtime dependencies.

Installation

Install n8n-nodes-premely from Settings → Community nodes in n8n. Community nodes are
available on self-hosted n8n and supported n8n Cloud plans.

Release process

Verified n8n community nodes must be published by GitHub Actions with npm provenance. Direct
npm publish is intentionally rejected by the package's prepublishOnly gate.

One-time npm setup:

1. Because npm trusted publishing can only be configured after a package exists, create a
   short-lived granular npm token that can publish the first public version with 2FA bypass.
2. Save it as the NPM_TOKEN Actions secret on Premely/n8n-nodes-premely, publish the first
   version through the workflow, and then configure the package's trusted publisher as GitHub
   Actions repository Premely/n8n-nodes-premely, workflow publish.yml, with npm publish
   allowed.
3. Delete the NPM_TOKEN secret after the trusted publisher is active. Subsequent releases use
   GitHub OIDC and do not require a long-lived npm credential.

To publish from a clean main branch in the dedicated public repository, run npm run release
and select the intended semantic version. The release command runs the provider checks, creates
and pushes the version commit and tag, and the tag triggers the provenance workflow. After the
workflow succeeds, install the public registry package anonymously before submitting it through
the n8n Creator Portal.

Configure a verified workflow

1. Add an n8n Webhook node with the HTTP method set to POST.
2. In the Webhook node options, enable Raw Body. Use the production webhook URL, not the
   temporary test URL.
3. Configure the Webhook node to respond immediately so Premely receives a timely 2xx
   acknowledgement.
4. Add a Premely node after the Webhook node and select Verify Signed Event.
5. Create a Premely Webhook API credential. Paste the signing secret shown once when the n8n
   destination is created in Premely. Never place this secret in workflow fields or logs.
6. Keep Raw Body Source set to Binary Property, Binary Property set to data, and
   Headers set to ={{ $json.headers }}.
7. Publish the workflow, then paste the Webhook node's production URL into the n8n destination in
   Premely and send a connection test.

If an intermediary changes even one byte of the request body, or changes a signed delivery header,
the node fails closed and the event is not emitted.

Output

Successful executions output the verified canonical Premely envelope:

{
  "schema_version": 1,
  "delivery_id": "019d...",
  "event_id": "019d...",
  "event_type": "integration.test.v1",
  "occurred_at": "2026-08-26T12:00:00.000Z",
  "workspace_id": "019d...",
  "site_id": "019d...",
  "data": {
    "message": "Premely connection test"
  }
}

Supported event types are integration.test.v1, usage.warning.v1, usage.limited.v1,
installation.verified.v1, alert.triggered.v1, export.completed.v1, export.failed.v1, and
revenue.recorded.v1.

Security

• Signature verification uses constant-time comparison.
• Verification covers the original request bytes, before JSON parsing.
• Schema version, event type, UUIDv7 identifiers, timestamp, and delivery headers are checked.
• The node emits neither the signing secret nor the raw request body.
• Requests larger than Premely's 16 KiB delivery limit are rejected.

Rotate the destination in Premely if a signing secret may have been exposed. Report security issues
privately to support@premely.io.

Support and legal

• Premely n8n guide
• Support
• Privacy notice
• Terms of service

Released under the MIT License.