Second Factor & Secrets
Confirm sensitive changes with a passkey or an authenticator app, and let n8v read credentials from your own vault instead of pasting them.
Both features are off by default and are switched on per account. If you do not see Security or Secrets in Settings, they are not on for your account yet.
Second factor
Signing in says who you are. Before a change that hands out access, n8v can ask again: a passkey, or a code from an authenticator app.
What asks for it
- Creating an API key or a CLI token
- Letting assistants use a connector tool that can change things
- Connecting or replacing the Cloudflare connector
- Allowing an app to connect to your account, or adding another way to sign in
- The Secrets page
Taking access away never asks: you can always revoke a key or switch a connector off straight away.
Nothing asks before you have set a factor up, so switching this on cannot lock you out. The Secrets page is the exception: it always needs one.
Once you confirm, it stays confirmed for 10 minutes on that sign-in, then n8v asks again. Lock now in Settings, Security ends it early.
Set it up
- Sign out and sign in again. A first factor can only be added within 15 minutes of signing in, so that nobody holding an old session of yours can add their own.
- Open Settings, Security.
- Add passkey and confirm with your fingerprint, face or device PIN.
- Save the ten recovery codes in your password manager. They are shown once.
- Optionally set up an authenticator app as a fallback: scan the QR code and enter the 6-digit code.
Which factor to use
| Factor | Good for | Keep in mind |
|---|---|---|
| Passkey | Every day. Nothing to type. | It only answers to n8v, so a look-alike site cannot use it. |
| Authenticator app | A fallback on a device without your passkey | A code can be typed into a fake page. Check the address first. |
| Recovery code | When you have neither | Each works once. Make new ones in Settings, Security when few are left. |
After five wrong tries n8v pauses checks for ten minutes.
If you lose every passkey, your authenticator app and your recovery codes, n8v cannot reset them from an email. Keep the recovery codes somewhere safe.
Settings, Security also lists every time a second factor was asked for or changed on your account.
Secrets from your own vault
A credential should not have to pass through a chat or a form. Where the vault is switched on, n8v reads each secret from your Infisical at the moment it needs it and keeps no copy.
- You set the value in Infisical, or send it there from n8v. n8v shows the exact path and key, with a link that opens that path, and a form that passes what you type on to your vault.
- Rotation happens in one place. Change the value in Infisical and n8v uses the new one within a minute.
- n8v never shows a value. Settings, Secrets lists paths, which keys are set, and whether a check passed. What you type into its form is sent to your vault and not shown again.
- No shared password between n8v and your vault. n8v signs in to Infisical with a key of its own; your vault holds only the public half.
- Every read and every change is logged by path in n8v, never with the value.
The Secrets page
Settings, Secrets asks for your second factor every time. It shows:
- where your vault is, and whether n8v can reach it, with the exact reason if it cannot
- each path n8v expects and which feature reads it
- which keys are set
- Open in Infisical, a link to that path
- Check, which proves the secret works: for a Cloudflare token, that it is active and which accounts it reaches
- Set values, a form with a field for each key
Setting a value from n8v
Set values on a path opens a field for each key. Fill them, or paste everything at once into any field: lines of KEY=value, or a JSON object.
For Apple Wallet you can give the certificate and key as PEM, or the .p12 file you exported together with its password. n8v opens the .p12, stores its certificate and key in your vault, and keeps neither the file nor the password.
- The values are checked before anything is sent on. If a password does not open the certificate, or a token is not active, n8v says so and your vault is not changed.
- An empty field keeps what your vault already holds.
- n8v keeps no copy and never fills a field with what is in your vault.
- n8v's machine identity needs permission to create and edit secrets at that path in Infisical. Without it the form tells you, and you can set the value in Infisical instead.
Cloudflare connector
With the vault on, the Cloudflare connect dialog shows a path instead of a field to paste into: /connectors/cloudflare, key API_TOKEN. Set the token there, then Connect. n8v verifies it with Cloudflare and stores only the path.
Phone connector
Phone reads four keys at /connectors/phone: ELEVENLABS_API_KEY for the voice provider, and TWILIO_ACCOUNT_SID, TWILIO_API_KEY and TWILIO_API_SECRET for the carrier. Use an API key pair for the carrier, never the account's own auth token: n8v refuses an account id where the key id belongs. Check asks the voice provider which numbers can call out, and asks the carrier to price a route and list the account's calls. It tells you which key a provider refuses, and it never rings a phone. Phone has no field to paste a key into anywhere else. See Phone.
If your vault cannot be reached for more than a few minutes, or access is withdrawn in Infisical, connectors that read from it stop until it is back. That is deliberate: n8v does not keep working on a credential it can no longer confirm.