Description

n8n-nodes-velocms

VeloCMS community node for n8n. Trigger workflows on blog events (post published, member subscribed, order paid) and automate content management — all without writing code.

Installation

In your n8n instance, go to Settings → Community Nodes and install:

n8n-nodes-velocms

Or via CLI:

npm install n8n-nodes-velocms

Credentials setup

1. In your VeloCMS admin panel, go to Settings → API Keys.
2. Create a new API key with the scopes you need:
– posts:read, posts:write — Post resource
– media:read, media:write — Media resource
– comments:read, comments:write, comments:moderate — Comment resource
– members:read, members:write — Member resource
– webhooks:read, webhooks:write — Webhook resource + the Trigger node (required)

API access requires a Pro or higher VeloCMS plan, and webhook subscriptions require Pro or higher as well.
3. Copy the generated key (shown once, starts with velo_...).
4. In n8n, add a new VeloCMS API credential:
– API Key: paste your velo_... key
– Base URL: your blog URL (e.g. https://myblog.velocms.org)

VeloCMS Trigger node

Starts your workflow when VeloCMS events occur.

Supported events

| Event | Fires when |
|—|—|
| post.created | A new post is created |
| post.updated | A post is edited |
| post.published | A post is published or scheduled |
| post.unpublished | A published post is reverted to draft |
| post.deleted | A post is permanently deleted |
| page.published | A page builder page is published |
| member.subscribed | A reader subscribes (free or paid) |
| member.unsubscribed | A member cancels |
| member.tier_changed | A member upgrades or downgrades |
| comment.posted | A new comment is submitted |
| comment.approved | A comment is approved by the admin |
| comment.deleted | A comment is deleted |
| order.paid | A product order is paid |
| order.refunded | An order is refunded |
| order.shipped | An order is marked as shipped |
| product.created | A new product is created |
| product.updated | A product is updated |
| cart.abandoned | Included for forward-compatibility — not yet dispatched by VeloCMS |
| gift_card.issued | A gift card is purchased or admin-issued |
| media.uploaded | A file is uploaded to the media library |

HMAC signature verification

Every VeloCMS webhook delivery is signed with HMAC-SHA256. The trigger node automatically:

1. Reads X-VeloCMS-Signature: v1={hex} and X-VeloCMS-Timestamp headers.
2. Rejects deliveries where |now - timestamp| > 300 seconds (replay protection).
3. Computes the expected HMAC of v1:{timestamp}:{raw_body} with your subscription secret.
4. Returns HTTP 401 and stops workflow execution if the signature does not match.

The subscription secret is generated by VeloCMS when you activate the workflow and is stored securely in n8n’s workflow static data. It is never exposed in logs or workflow output.

Delivery envelope

Every workflow item is the event’s data payload — for a post.* event, that looks like:

{
  "post_id": "abc123",
  "title": "My Post Title",
  "slug": "my-post-title",
  "status": "published",
  "published_at": "2026-06-14T10:00:00Z",
  "excerpt": "A short summary...",
  "tags": ["intro", "welcome"],
  "author_name": "Jane Doe",
  "tenant_id": "tenant-uuid"
}

The full delivery envelope (with id, event, version, created, tenant) is visible in the raw webhook headers/body if you need it for deduplication.

VeloCMS Action node

Interacts with the VeloCMS REST API v1. The resource/operation set below reflects the endpoints VeloCMS’s route handlers actually implement — a couple of endpoints some third-party docs describe (e.g. POST /members, GET /comments/{id}) don’t exist on the real API, so those operations were never exposed here.

Resources and operations

| Resource | Operations |
|—|—|
| Post | Create, Update, Get, Get All, Publish, Delete |
| Member | Get All, Delete (members are created via the reader-facing subscribe flow, not the admin API) |
| Media | Get, Get All, Upload from URL, Delete |
| Comment | Get All, Create, Moderate (sets status to Approved / Pending / Spam) |
| Webhook | Create, Get All, Get, Delete, Test, Rotate Secret |

Upload from URL downloads the file from the URL you provide and re-uploads it to VeloCMS as a real multipart/form-data request (VeloCMS’s media endpoint requires an actual file part, not a JSON URL reference). Files over 25 MB are rejected.

Pagination

Post / Member / Media / Comment “Get All” operations support:

• Return All: fetches every page automatically (up to 100 items/page).
• Limit + Page: fetches one specific page.

Webhook “Get All” is the one exception: GET /api/v1/webhooks always returns the tenant’s complete subscription list in one response (it’s not a server-paginated endpoint — subscription counts are small). The node still honors Return All / Limit + Page, but applies them client-side over that full list.

Rate limiting

If VeloCMS rate-limits your request (HTTP 429), the node throws a NodeOperationError with the Retry-After seconds in the message so you can handle it in your workflow’s error path.

Example workflows

Post published → send Slack notification

1. Add VeloCMS Trigger → select event post.published.
2. Add Slack node → send message: New post: {{$json.title}} — https://myblog.velocms.org/blog/{{$json.slug}}.

New member → add to Mailchimp audience

1. VeloCMS Trigger → event member.subscribed.
2. Mailchimp node → add/update subscriber with {{$json.email}}.

Order paid → create invoice in QuickBooks

1. VeloCMS Trigger → event order.paid.
2. QuickBooks node → create invoice with order data from {{$json}}.

Weekly post report → email digest

1. Schedule Trigger → every Monday 09:00.
2. VeloCMS (Action) → Post → Get All → filter by status=published.
3. Gmail → send digest to editorial team.

New comment → moderate automatically

1. VeloCMS Trigger → event comment.posted.
2. A filter/rule node checks the comment body for spam signals.
3. VeloCMS (Action) → Comment → Moderate → set Status to spam or approved.

Webhook subscription lifecycle

When you activate a workflow with the VeloCMS Trigger:
1. n8n calls the create lifecycle method.
2. The node registers a webhook subscription in VeloCMS (POST /api/v1/webhooks).
3. VeloCMS returns a subscription ID and signing secret, both stored in the workflow’s static data.

When you deactivate the workflow:
1. n8n calls the delete lifecycle method.
2. The subscription is removed from VeloCMS (DELETE /api/v1/webhooks/{id}).

When n8n restarts with an active workflow:
1. n8n calls checkExists (GET /api/v1/webhooks/{id}).
2. If the subscription still exists → continue using it.
3. If not → create a new one automatically.

Secret rotation

If you need to rotate your webhook’s signing secret, use the Action node’s Webhook → Rotate Secret operation (POST /api/v1/webhooks/{id}/rotate-secret) — it returns the new secret once, immediately invalidating the old one. n8n’s Trigger node won’t automatically pick up a secret rotated this way, though, so:

1. Deactivate the workflow using the VeloCMS Trigger.
2. Reactivate it — a fresh subscription with a new secret is created automatically.

If you rotate your VeloCMS API key instead, just update the VeloCMS API credential with the new key — no workflow reactivation needed.

Troubleshooting

“No webhook secret stored” — The workflow was activated without going through the VeloCMS create lifecycle. Deactivate and reactivate the workflow.

“Invalid signature” — The delivery was rejected because the HMAC didn’t match. Common causes:

• The webhook secret was rotated (see Secret rotation above).
• The raw body was modified in transit (rare).
• Clock skew between VeloCMS and your n8n instance is > 5 minutes.

“VeloCMS rate limit reached” — Your API key has exceeded its hourly quota. The error message includes the Retry-After seconds.

“401 Invalid API key” — Check that the API key starts with velo_ and has not been revoked. In VeloCMS admin: Settings → API Keys.

“Invalid or unknown fields in request body” (Post Create/Update) — VeloCMS’s API rejects unrecognized JSON keys rather than silently dropping them. If you’re building a custom expression for the post body, use contenthtml (not content/body) and featuredimageurl (not featuredimage).

Support

• Documentation: velocms.org/help/how-do-i-connect-zapier-or-n8n-to-velocms
• Issues: github.com/VeloCMS/n8n-nodes-velocms/issues
• VeloCMS: velocms.org

License

MIT — see LICENSE.