Advertising 37 AI & Machine Learning 306 AI Assistants 552 AI Image 144 AI Video 80 AI Voice 127 Analytics 231 automation 1145 Cloud & Infrastructure 179 Communication 624 Copywriting 55 CRM 445 Database 229 Developer Tools 802 E-commerce 220 Email Marketing 181 File Storage 209 Finance 289 HR & Recruiting 58 IoT & Hardware 56 Media 204 Project Management 227 SaaS 484 Security 237 SEM & PPC 30 SEO 131 Social Media 225 Utilities 694 VoIP & Telephony 289
Back to Tutorials

Verified vs Unverified n8n Community Nodes: What’s the Difference?

Posted by Oct 27, 2026

n8n splits community nodes into two groups: verified nodes, which n8n has reviewed, and unverified nodes, which are any package on npm built for n8n. The difference decides where you can use a node (n8n Cloud or only self-hosted), how you install it, and how much you have to trust its author. For the basics, see What Are n8n Community Nodes?. This page explains both, based on the official n8n documentation.

The short answer

Verified community nodes Unverified community nodes
Reviewed by n8n Yes, against data and system security requirements No
n8n Cloud Yes No
Self-hosted n8n Yes Yes
Where you install it Nodes panel on the canvas, under More from the community Settings > Community Nodes, npm on the command line, or environment variables
Who can install Instance owner and admins Instance owner and admins
Runtime dependencies Not allowed Any
Reads environment variables or files Not allowed Possible
Switch to turn off (self-hosted) N8N_VERIFIED_PACKAGES_ENABLED=false N8N_UNVERIFIED_PACKAGES_ENABLED=false

What “verified” means

A verified community node is a package that its author submitted to n8n through the n8n Creator Portal and that n8n inspected before making it available in the nodes panel. n8n’s docs say these nodes have to meet a set of data and system security requirements, plus technical and UX standards. Anyone with verified community nodes enabled can find and install them from the nodes panel, on self-hosted n8n and on n8n Cloud.

Verified does not mean n8n wrote the node. It is still a community package, published on npm by its author. The difference is the review and the rules the package had to follow to pass it.

What a node needs to get verified

n8n publishes its verification guidelines. The main rules:

  • One service per package. Packages that wrap several unrelated APIs or act as a proxy for several services usually don’t qualify. A trigger node for the same service may ship alongside the main node.
  • Not a copy of an existing node. If a node improves on one n8n already has, n8n asks for a pull request instead. n8n also isn’t accepting logic or flow control nodes at the moment.
  • No external dependencies. Verified nodes can’t use run-time dependencies.
  • No access to environment variables or the file system. All data has to come in through node parameters.
  • Traceable source. The npm repository link must point to a public GitHub repository, the npm and GitHub authors must match, and the license must be MIT.
  • Published from GitHub Actions with provenance. From May 1, 2026, nodes submitted for verification must be published with a GitHub Actions workflow that includes an npm provenance statement. Provenance lets anyone check which workflow, repository and commit built the package.
  • Documentation and language. A README with usage instructions and authentication details, and an interface and documentation in English only.
  • Code quality. TypeScript, n8n’s node guidelines and UX guidelines, and a clean result from npx @n8n/scan-community-package.

n8n also states it can reject nodes that compete with its paid features, especially enterprise functionality.

What “unverified” means

Any npm package built as an n8n community node can be installed on a self-hosted instance, verified or not. n8n’s docs describe this as installing unverified code from a public source and list the risks:

  • A community node has full access to the machine n8n runs on and can do anything, including harmful actions.
  • It has access to the data in your workflows.
  • A new version can include breaking changes that stop workflows using the node.

That is why the install screen in Settings asks you to confirm I understand the risks of installing unverified code from a public source. n8n keeps a blocklist of packages it won’t install at all, for example ones that are malicious, and you can report a bad node to security@n8n.io.

Unverified is not the same as unsafe. It means nobody at n8n checked the code, so the checking is up to you.

Can I use unverified nodes on n8n Cloud?

No. On n8n Cloud you can only install verified community nodes, from the nodes panel. To use an unverified node you need a self-hosted n8n, and the free Community edition can install them (see n8n Community Edition vs Cloud). The instance owner can also hide verified nodes on Cloud by turning off Verified community nodes under Instance settings in the Cloud console.

How to tell if a node is verified

Search for it in the nodes panel of a recent n8n version. If a verified community node matches your search, it shows in a More from the community section at the bottom of the panel, with a detail view of its actions and an Install button. A package you can only install by typing its npm name in Settings > Community Nodes is unverified.

Controlling verified and unverified nodes on self-hosted n8n

Three environment variables decide what a self-hosted instance allows:

  • N8N_COMMUNITY_PACKAGES_ENABLED (default true): set to false and neither verified nor unverified packages are available.
  • N8N_VERIFIED_PACKAGES_ENABLED (default true): shows or hides verified nodes in the nodes panel.
  • N8N_UNVERIFIED_PACKAGES_ENABLED (default true): allows or blocks installing unverified packages from npm.

To allow only reviewed nodes, keep verified nodes on and set N8N_UNVERIFIED_PACKAGES_ENABLED=false. If you manage packages with environment variables (n8n 2.21.0 and later) and turn unverified packages off, n8n refuses to start with a package that isn’t in its vetted registry unless you pin its checksum.

Checking an unverified node before you install it

The verification rules make a useful checklist for any package, verified or not. On each node page on this site you can see the package’s weekly and monthly npm downloads, its release history, and links to npm and the GitHub repository. From there:

  • Open the repository and check it is public and matches the npm package.
  • Look at the package’s dependencies on npm. Verified nodes have none.
  • Check how recently it was released and whether the README explains setup and credentials.
  • Pin a version when you install (package@1.2.3) and read the release notes before you upgrade.

Our step-by-step guide How to Install n8n Community Nodes covers every install method, upgrades and rollbacks.

Browse community nodes by service

WhatsApp, Evolution API, Telegram, MCP, OpenAI, Claude, Gemini and Chatwoot. For a ranked comparison of one service, read Best n8n Community Nodes for Evolution API (WhatsApp).

FAQ

Are verified n8n community nodes made by n8n?

No. They are built and published by community authors. n8n reviews them before they appear in the nodes panel.

Are verified community nodes available on n8n Cloud?

Yes. They are the only community nodes you can install on n8n Cloud.

Can I install an unverified node on n8n Cloud?

No. Installing packages from npm needs a self-hosted n8n.

How do I block unverified community nodes on my server?

Set N8N_UNVERIFIED_PACKAGES_ENABLED=false. Verified nodes stay available unless you also set N8N_VERIFIED_PACKAGES_ENABLED=false.

How does a developer get a node verified?

Build it to n8n’s verification guidelines (ideally starting from the n8n-node CLI scaffold), publish it to npm from GitHub Actions with provenance, then submit it in the n8n Creator Portal. The full walkthrough is in How to Build and Publish Your Own n8n Community Node.

Why would n8n reject a node?

Common reasons in the guidelines: it wraps several services, duplicates an existing node, is a logic or flow control node, uses run-time dependencies, reads environment variables or files, or competes with n8n’s paid features.