n8n-automation-expert

Workflow Automation & n8n AI Orchestration Expert (2026 Edition)

English | Bahasa Indonesia

---

English

Orchestration & Integration

• Upstream Triggers & Schedules: cron-scheduler-expert, async-queue-temporal-expert, event-driven-architect
• AI Agent & LLM Nodes: ai-llm-integration-expert, mcp-server-architect, chatbot-messaging-expert
• Communications & Billing: email-notification-expert, payment-gateway-expert, doku-payment-gateway
• Security & Secrets: zero-trust-secret-vault, rate-limit-abuse-prevention, anti-slop
• Lifecycle & Governance: zero-to-prod-orchestrator, session-memory-manager

Description

Production engineering guide for self-hosted workflow automation using n8n (v1.60+), Zapier, and Make. Covers building fault-tolerant automation pipelines, custom TypeScript nodes, webhook triggers with HMAC SHA-256 signature verification, AI Agent nodes integrating Model Context Protocol (MCP) tools, sub-workflow error triggers, and high-volume queuing via n8n Queue Mode (Redis + BullMQ).

Trigger Conditions

• Designing event-driven automations between SaaS tools (Slack, Discord, HubSpot, Notion, Stripe).
• Deploying self-hosted n8n in Docker or Kubernetes for data privacy compliance (GDPR/HIPAA).
• Creating AI-powered workflow pipelines with LangChain/n8n AI Agent nodes.
• Handling secure webhook ingestion with cryptographic signature validation.

Production n8n Webhook HMAC Signature Validation (TypeScript / Code Node)

// n8n Code Node (JavaScript/TypeScript runtime)
// Validates incoming HMAC signature from DOKU or Stripe before executing downstream nodes
import crypto from 'node:crypto';

const items = $input.all();
const rawBody = $json.body;
const signatureHeader = $json.headers['x-signature'] || $json.headers['x-hub-signature-256'];
const secretKey = $env.WEBHOOK_HMAC_SECRET;

if (!signatureHeader || !secretKey) {
  throw new Error('[n8n-Security] Missing signature header or HMAC secret.');
}

const computedSignature = crypto
  .createHmac('sha256', secretKey)
  .update(typeof rawBody === 'string' ? rawBody : JSON.stringify(rawBody))
  .digest('hex');

// Timing-safe equality check to prevent side-channel timing attacks
const isValid = crypto.timingSafeEqual(
  Buffer.from(computedSignature, 'utf8'),
  Buffer.from(signatureHeader.replace('sha256=', ''), 'utf8')
);

if (!isValid) {
  throw new Error('[n8n-Security] Invalid HMAC signature. Unauthorized webhook invocation.');
}

return items.map(item => ({
  json: {
    ...item.json,
    verified: true,
    processedAt: new Date().toISOString()
  }
}));