What Is n8n? A Plain-English Guide to Workflow Automation, Self-Hosting, and n8n vs Zapier

n8n is a workflow automation tool you build by connecting blocks called nodes on a canvas. One node starts the run, the rest fetch, transform and send data. It runs on n8n Cloud or on a server you control, and the self-hosted version is free to use inside your own business.

That is the short answer. The rest decides whether you keep it: how a workflow is put together, what self-hosting costs you in attention, what n8n charges for, six workflows a small business can build this week with a CRM in the middle of them, and an honest comparison with Zapier and Make.

We build a CRM and publish an n8n node for it, so read this as a vendor writing about a tool it depends on. Everything about n8n comes from n8n's own documentation, linked inline, checked in September 2026.

If you want to skip the theory, the Pinlyx n8n node page lists the exact resources, operations and credential fields, and pricing says which plan carries API keys.

What is n8n? The short definition

n8n is a workflow automation platform. You open a canvas, drop nodes onto it, and draw connections between them. Each node does one job: listen for an event, call an API, reshape a field, branch on a condition, write a row. Data flows left to right, each node passing its output to the next. Three things separate it from the automation tools most people met first.

It is node based rather than step based. A Zap is a list. An n8n workflow is a graph: it can fork into two branches, merge them back, loop over a list, call a sub-workflow and come back with the answer. That matters the first time a real process turns out not to be a straight line, which is usually about three weeks in.

You can host it yourself. The same software that runs on n8n Cloud runs in a Docker container on a machine you rent for the price of a couple of coffees. Your data, your credentials and your logs stay on that machine. For a business handling customer records under GDPR or an internal policy about where data lives, that is not a preference, it is the requirement.

It does not hide the code from you. There is a Code node that runs JavaScript or Python, an HTTP Request node that will call any API on earth, and an expression language for transformations not worth a node. You need none of it to start, and you will want all of it by month two.

Fair-code and the Sustainable Use License

People call n8n open source, and n8n does not. That is worth ten minutes if you are building anything commercial on it.

The source is on GitHub and you can read every line. The license is the Sustainable Use License, Version 1.0 (checked September 2026), and its central clause is short: "You may use or modify the software only for your own internal business purposes or for non-commercial or personal use." Distribution is allowed only free of charge and for non-commercial purposes, and you may not alter or remove the licensing notices. Source files with .ee. in the name, or inside a directory ending in .ee, are excluded entirely and require a separate n8n Enterprise License.

n8n calls this model fair-code. The faircode.io definition (checked September 2026) is four clauses: software that "is generally free to use and can be distributed by anybody", "has its source code openly available", "can be extended by anybody in public and private communities", and "is commercially restricted by its authors". That page lists n8n under the Sustainable Use License.

What it means for the three cases small businesses actually hit:

• Running n8n to automate your own company. Clearly inside "your own internal business purposes". The normal case, and free.
• Running n8n to deliver client work as an agency. Read the license yourself and ask n8n if the answer matters to your revenue. The line between internal use and serving third parties is exactly where fair-code licenses are strict, and a blog post is not legal advice.
• Reselling a hosted n8n as your own product. Not permitted without a commercial agreement. That restriction is the point of the license.

None of this makes n8n worse than an MIT-licensed tool, just different in one direction. It is also not a CRM, a help desk or a data warehouse: it is the wiring between those things, so buy it for what it connects, not what it stores.

How an n8n workflow actually works

Six concepts cover almost everything, in this order.

Triggers: every workflow starts with exactly one

A workflow does nothing until something starts it. n8n calls the starting blocks trigger nodes, and its documentation is blunt: "all production workflows need at least one trigger to determine when the workflow should run" (node types, checked September 2026). The four you will use:

• Webhook. n8n gives you a URL. Anything that can POST to it starts your workflow, in the second it happens.
• Schedule Trigger. Every fifteen minutes, every day at 09:00, every first of the month.
• App triggers. A Shopify order, a Telegram message, a new row in a sheet. Most are webhooks the node registers for you.
• Manual. The Execute Workflow button: how you build and test.

Nodes, and the item model that confuses everyone once

Data moves between nodes as a list of items, each item a JSON object. This is the idea that makes n8n click, and the idea that makes your first workflow behave strangely.

A node runs once per item. If the node before it returned forty contacts, the node after it fires forty times, not once with an array of forty. That is what you want when creating forty records and not what you want when sending one summary email, where the fix is a node that aggregates the list back into a single item first.

The documentation is organized by node category: trigger nodes start a run, core nodes "provide functionality such as logic, scheduling, or generic API calls", action nodes talk to a specific service, and cluster nodes are groups where a root node takes sub-nodes underneath it. That last shape is what every AI node uses.

Expressions: the double curly braces

Anywhere a field takes a fixed value, it also takes an expression in handlebars. {{ $json.email }} means "the email field of the item currently passing through". Nested fields are dotted: n8n's own example is {{$json.body.city}} (expressions documentation, checked September 2026), with {{$json['body']['city']}} as the bracket form.

{{ $json.fieldName }}                  a field on the current item
{{ $('Webhook').item.json.body.id }}   a field from a named earlier node
{{ $now }}                             the current time, as a Luxon object
{{ $json.name.toUpperCase() }}         plain JavaScript on the value

You can put JavaScript inside an expression, and JMESPath is available for deeper queries. If an expression grows past one line, move it into a Code node where you can read it.

The six core nodes you will use every week

Read the Webhook node's options once. It supports DELETE, GET, HEAD, PATCH, POST and PUT, authentication by basic auth, header auth or JWT, and three response modes. It also carries a Raw Body option and an IP(s) Allowlist (Webhook node documentation, checked September 2026). Both matter later in this post.

Error handling, before you need it

Automations fail. APIs return 500s, tokens expire, someone types a letter into a phone number field. Set at least two of these on day one.

On an individual node the settings are Retry On Fail ("When an execution fails, the node reruns until it succeeds"), plus three choices for what happens when it still fails: Stop Workflow, Continue, or Continue (using error output), which sends the error down a second line so you can handle it deliberately (node settings, checked September 2026).

At the workflow level you pick an Error Workflow: a separate workflow starting with the Error Trigger node that runs whenever this one fails. One of those posting to your team chat covers every automation you will ever build, which is the highest return on twenty minutes in this tool. A Stop and Error node also lets you fail on purpose, turning "this data is nonsense" into a visible failure instead of a silent bad write (error handling, checked September 2026).

The executions log, which is the reason to trust any of this

Every run is recorded. You open it, you see each node, the exact data that went in and came out, and where it stopped. Debugging in n8n is reading a transcript rather than guessing. You can also redact execution data so sensitive payloads are not sitting in the log.

One detail matters for billing on Cloud: only production executions count against a quota. n8n's documentation states these "are executions started automatically by triggers, schedules, or polling", and that manual runs, sub-workflow runs, error workflow runs, polls that found no data and malformed requests do not count (executions documentation, checked September 2026).

n8n Cloud or self-hosted: which one actually fits you

This is the first real decision and people get it backwards. They pick self-hosting to save money, then spend four hours on a TLS certificate.

Choose Cloud if nobody on your team is comfortable in a terminal, or your automations touch money and downtime is expensive, or you want to find out whether this tool is for you before spending a weekend on infrastructure.

Choose self-hosting if customer data cannot leave your jurisdiction, or you already run servers and one more container is a Tuesday, or you need an unverified community node like ours.

The honest middle path: start on Cloud, prove the workflows are worth having, then move them to your own server if the numbers or the rules say so. Workflows export as JSON, so the migration is a file, not a rebuild.

How to install n8n

Three routes. All three get you to an editor at http://localhost:5678.

Docker, the one to use

n8n publishes the n8nio/n8n image. Its documented run command creates a named volume so your work survives a restart, and sets both timezone variables (Docker installation, checked September 2026):

docker volume create n8n_data

docker run -it --rm \
  --name n8n \
  -p 5678:5678 \
  -e GENERIC_TIMEZONE="Europe/London" \
  -e TZ="Europe/London" \
  -e N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true \
  -e N8N_RUNNERS_ENABLED=true \
  -v n8n_data:/home/node/.n8n \
  n8nio/n8n

Two flags earn their keep. TZ sets the system timezone so scripts and date commands agree with you. GENERIC_TIMEZONE "sets the correct timezone for schedule-oriented nodes", which decides whether your 09:00 digest goes out at 09:00. The volume at /home/node/.n8n is where everything lives, so that path is what your backup job copies. Updating is docker pull n8nio/n8n and a restart.

npx, for ten minutes of curiosity

npx n8n

That is the whole command. n8n requires "a Node.js version between 20.19 and 24.x, inclusive" (npm installation, checked September 2026), and a global install is npm install n8n -g then n8n start. Fine on a laptop, wrong for production, because nothing restarts it when the machine reboots.

n8n Cloud

Sign up, pick a plan, build. Nothing to install and the editor is the same editor. Plan details are on n8n.io/pricing (checked September 2026), covered in the next section.

A short checklist for a small VPS

Docker Compose is the setup n8n documents for a server, and its guide notes that "There's no database service defined here. n8n falls back to its built-in SQLite database" unless you add PostgreSQL yourself (Docker Compose documentation, checked September 2026). This order avoids rework:

1. Point a subdomain at the server first. Webhook URLs are baked from the hostname. Changing it later means re-registering every webhook you gave to a third party.
2. Put a reverse proxy in front with a real certificate. Your webhook URLs go to services that refuse plain HTTP, and your login page carries credentials.
3. Close every port except the proxy. n8n's own guide states the goal plainly: "Only n8n's port is open on your cloud firewall."
4. Set the timezone twice, TZ and GENERIC_TIMEZONE, before you build anything scheduled.
5. Move to PostgreSQL if this becomes load bearing. SQLite is fine for a handful of workflows and wrong once several run concurrently.
6. Back up the data directory and the encryption key. A backup without the key restores workflows that cannot authenticate to anything.
7. Put authentication in front of the editor while you are still testing. An open n8n editor on a public IP is an open door to every credential in it.
8. Write down your upgrade routine. Pull, restart, check the executions list for red. Five minutes, once a month.

Is n8n free? What it actually costs

Yes and no, and the split is clean.

Self-hosted is free software. The pricing page lists Community Edition as a free, self-hosted version available on GitHub, and n8n meters executions only on its Cloud plans, so a self-hosted instance has no execution quota (n8n.io/pricing, checked September 2026). You still pay for a server and for your own time, which is the real cost and the one nobody budgets.

Community Edition is not feature complete, and n8n says so. Its documentation describes the free self-hosted edition as having "almost the complete feature set of n8n", with these excluded: custom variables, environments and version control, external secrets and storage, log streaming, multi-main mode, projects and RBAC, SSO by SAML or LDAP, and workflow or credential sharing. Registering your email unlocks three more at no cost: folders, "Debug in editor: Copy and pin execution data when working on a workflow", and "Custom execution data: Save, find, and annotate execution metadata" (community edition features, checked September 2026). None of the paid-only items are things a small business misses in month one.

What n8n Cloud costs

Read as listed on n8n.io/pricing in September 2026. Prices there are shown in euros, billed annually, with a note that annual billing saves 17 percent.

There is a free trial, and the page says no credit card is required on the entry plans. Prices move, so treat that table as a dated snapshot rather than a fact.

The pricing unit is the thing to understand

This is where n8n differs from most competitors, and it matters more than the headline number. n8n bills per workflow execution: "An execution is a single run of your entire workflow. It doesn't matter how many steps are in the workflow...It's still a single execution."

Read that against a per-task model. A workflow with fourteen nodes that runs a thousand times a month is a thousand executions. On a tool that counts each successful step, the same work can be ten thousand billable units or more. Do the arithmetic with your own two numbers first: how often your busiest workflow fires, and how many steps it has.

AI in n8n: what the AI Agent node does, and what it does not

n8n put AI at the center of its product, and the shape is worth understanding before you decide it solves your problem.

The AI Agent node is a root node in a cluster: you attach sub-nodes and it orchestrates them. n8n describes the pattern exactly: "Connect a chat model and one or more tools, and the agent decides which tools to call to complete a task." You must connect at least one tool sub-node, and in current versions all AI Agent nodes work as a Tools Agent, with older agent type settings deprecated (AI Agent node documentation, checked September 2026). So an agent is four parts: a model that reasons, an instruction that constrains it, tools it may call, and optionally a memory. The model provider is a sub-node too, which makes swapping one out a two-minute job.

What this is genuinely good at: classifying free text into a label you can branch on, extracting structured fields from an unstructured message, drafting a reply a human approves, and choosing between tools when the request has no fixed shape.

What it is not: deterministic. An agent that picks the wrong tool on run 40 will not tell you it was unsure, and n8n's own agent documentation says agents "can make mistakes" (agents documentation, checked September 2026). Anything that touches money, sends to a customer or deletes a record deserves a human in the loop or a rule instead of a judgment call.

The rule we use: if you can write the condition as an IF node, write it as an IF node. Models are for "is this person annoyed", not "is this value above 1000". One cost note people miss: the LLM is not in your n8n bill. You connect your own provider account and the tokens come out of it. Our AI agents work the same way, for the same reason: you own the key, you see the invoice, and you can change provider without asking us.

None of what follows answers a customer in their own words. That is a different build with different risks, and it is covered in how to build a WhatsApp chatbot and AI sales agent.

Six workflows a small business can actually run

Generic examples are why automation articles are useless. Here are six, node by node, all built around a CRM, because a CRM is where most small business automations start or end. The CRM nodes below are ours, and where our node cannot do something, this says so.

Our node, published to npm as n8n-nodes-crmsolid, exposes three resources: Contact (Create, Get, Get Many, Update, Delete), Deal (Create, Get Many) and Conversation (Get Many). Anything outside that list is one HTTP Request node away on the public REST API.

One: a website form becomes a contact, and your team hears about it

1. Form Trigger, or a Webhook node behind your own form. Anything that hands the next node a JSON object works.
2. Pinlyx, Contact, Create. Map Name from the form, then open Additional Fields for email, phone and notes. Set Platform to Email when the lead arrived without a messaging handle.
3. Set External ID to the submission id. This is what makes the workflow safe to re-run: a second create carrying the same external ID comes back as HTTP 409 naming the contact that already exists, instead of quietly making a second copy of the same person.
4. Telegram, Send Message to the chat your team watches: New lead: {{ $json.Name }} ({{ $json.Email }}).

Note the capital letters in those expressions. Our v1 API serializes PascalCase, so the node's output fields are Id, Name, Email, not their lowercase cousins. Copying a field name from a different API is the most common reason a first workflow prints "undefined".

Once replays are normal, set the Create node's error behavior to Continue, so a 409 arrives as an item with an error message and the batch keeps going. Leave it on Stop Workflow for the first week, while you still want to hear about every failure.

Two: a won deal writes a row in a sheet and posts to Slack

1. Webhook node, method POST, Raw Body switched on in Options. Copy the production URL.
2. Register the endpoint in the CRM under Tools, Integrations, Webhooks, New endpoint, subscribed to deal.won. Copy the signing secret.
3. Crypto node, action Hmac, type SHA256, encoding HEX, over the raw body.
4. IF node comparing sha256= plus that hex against {{ $json.headers['x-webhook-signature'] }}. False branch: stop. Everything downstream now trusts the payload.
5. Google Sheets, Append Row, mapping from the envelope.
6. Slack, Send Message to the revenue channel.

The payload arrives in a fixed envelope with the business data nested under data:

{
  "event": "deal.won",
  "id": "9f3c...",
  "deliveredAt": "2026-09-18T10:00:04.118Z",
  "data": {
    "id": 341,
    "userId": 12,
    "actorUserId": 15,
    "title": "Analytical Engines, annual",
    "contactId": 4821,
    "value": 15000,
    "currency": "USD",
    "fromStage": "negotiation",
    "origin": "panel",
    "closedAt": "2026-09-18T10:00:00Z"
  }
}

Which makes the Sheets mapping {{ $json.body.data.title }}, {{ $json.body.data.value }} and {{ $json.body.data.closedAt }}. Note that the webhook envelope is camelCase while the REST API is PascalCase. That inconsistency is ours and historical, so read the shape in front of you.

Two more things about this pattern. deal.won fires only on the transition into won, so a billing step cannot double-fire when somebody edits the deal afterwards. And every delivery carries X-Webhook-Event, X-Webhook-Event-Id, X-Webhook-Attempt and X-Webhook-Timestamp alongside the signature, so a retry is identifiable rather than a mystery second row. Deliveries retry eight times with exponential backoff, and an endpoint that fails twenty times running is disabled automatically.

Three: a new contact gets its email verified before anyone emails it

1. Webhook node subscribed to contact.created, signature verified as above.
2. IF node: does {{ $json.body.data.email }} exist? No email, nothing to verify, stop.
3. HTTP Request node to your verification service, with the address as a query parameter and the API key in a header credential.
4. IF node on the verdict the vendor returns.
5. Pinlyx, Contact, Update on the true branch, with Contact ID from {{ $json.body.data.id }} and a note recording what came back. On the false branch, the same Update writing the failure.

The honest limit: Contact, Update on our node writes plain fields only. Name, username, phone, email, platform, notes and external ID. Tags, lead scores, owners and pipeline stages exist on the REST API but are not among the node's eight operations. The next workflow shows the way around it.

Four: a store order tags the customer

1. Shopify Trigger or WooCommerce Trigger. WooCommerce publishes order.created, order.updated and order.deleted among others (WooCommerce Trigger, checked September 2026); the Shopify Trigger node (checked September 2026) covers the same ground on the other platform.
2. Pinlyx, Contact, Get Many, filtered on the buyer's email, limit 1.
3. IF node: did that return anything?
4. False branch: Pinlyx, Contact, Create with External ID set to the store's customer id, so re-runs collide instead of duplicating.
5. Both branches: HTTP Request node. PATCH https://api.crmsolid.com/v1/contacts/{{ $json.Id }} with a bearer credential and a JSON body of {"Tags": ["customer", "shopify"]}.

Say it plainly: step five is an HTTP Request node because our n8n node has no tagging operation. The API does, the node does not, and pretending otherwise would cost you an afternoon. One detail before you use it: sending Tags replaces the whole set on that contact rather than adding to it.

While you are in there, add an Idempotency-Key header to any create you run unattended. Our API stores the response against that key for 24 hours and replays it on a retry instead of creating a second record. The idempotency key entry covers how to derive one that stays stable: it must come from the intent, never from a fresh random value on the retry.

Five: a 09:00 digest of conversations nobody answered

1. Schedule Trigger at 09:00. Set the workflow timezone in settings first, or this fires in UTC and lands before you are awake.
2. Pinlyx, Conversation, Get Many, limit 50. This returns the threads that moved most recently across every connected channel, newest first.
3. Filter node keeping items where HasUnread is true.
4. Code node that turns the list into one item: sort by LastMessageAt, build an HTML list of Name, Platform and Preview.
5. Send Email node to whoever owns the inbox that morning.

Step four is where the item model bites and where you learn it for good. Without a node that collapses the list into a single item, the Send Email node fires once per unanswered conversation, and your colleague opens seventeen emails at 09:01 and stops reading them by Thursday.

Each row carries ContactId, Platform, Name, Username, LastMessageAt, HasUnread, Preview and Stage, and the preview is a preview: the node cannot page through a full thread, so a classifier downstream only ever sees the last message. Our unified inbox is where you read the threads. This workflow tells you which ones to open.

Six: a Telegram command opens a task

1. Telegram Trigger, listening for messages, with a bot credential. It defaults to "All updates except 'Chat Member', 'Message Reaction', and 'Message Reaction Count'" (Telegram Trigger, checked September 2026).
2. IF node: does the message text start with /task?
3. Code node splitting the rest of the message into a title and an optional due date.
4. HTTP Request node. POST https://api.crmsolid.com/v1/tasks with a bearer credential and a body of {"Title": "...", "Priority": "high", "DueAt": "2026-09-22T08:00:00Z"}.
5. Telegram, Send Message confirming the task id back into the chat.

Our n8n node has no Task resource. Contact, Deal and Conversation are the whole surface. Tasks, tags, lead scores, messages, invoices, sequences and pipelines live on the REST API and none are in the node, which covers the operations an automation reaches for most and leaves the rest to HTTP Request with the same authentication.

Which is the general lesson of all six. A good integration node saves you configuration, not capability. If a vendor's node cannot do something and their API can, you are one node away. If their API cannot do it either, no node will save you, and that is the question to ask before you buy.

n8n vs Zapier vs Make

"n8n vs Zapier" has a boring correct answer: they are aimed at different people, and the right one depends on which of you is doing the building.

What is Zapier, and what does Zapier do?

Zapier is a hosted automation service. You build a Zap: a trigger in one app and one or more actions in others, in a form-driven interface with no canvas and no code required. It is the oldest and largest product in the category, and its directory states "10118+ apps" (zapier.com/apps, checked September 2026). Nothing to host or maintain, which is what most of its users want.

Zapier bills per task, defined on its pricing page as: "A task is counted whenever Zapier successfully completes a unit of work for you. Failed actions are not counted." Triggers, polling and built-in tools such as Formatter are excluded. Free carries 100 tasks a month and two-step Zaps only; multi-step Zaps start on Professional, which the page lists from $29.99 monthly or $19.99 as the annual equivalent at its entry tier of 750 tasks, with Team from $103.50 monthly or $69.00 annual equivalent (zapier.com/pricing, checked September 2026).

Make, the third option people forget

Make is the visual middle ground: a canvas like n8n, hosted like Zapier. It bills per credit, defined as a module action: "Each module action in your scenario, like adding a Google Sheet row or fetching Gmail account data, counts as one credit." Free carries 1,000 credits a month with a 15 minute minimum scheduling interval; paid tiers are listed from $9 a month for Core, with a one minute minimum interval (make.com/en/pricing, checked September 2026).

The table

Integration counts are the least useful row in that table and the one people stare at. Every vendor counts differently, and none of it matters if the service you depend on is missing. Check your five most important tools by name, not the headline number.

The recommendation, honestly. Zapier if nobody wants to think about infrastructure, your workflows are short, and the per-task math stays comfortable. n8n if you want branching logic, self-hosting, a code escape hatch, or your workflows have many steps and run often enough that per-step billing hurts. Make if you want a visual canvas without running a server and the per-credit model fits your shape better.

Plenty of teams run two: a hosted tool for the simple things everyone can maintain, and n8n for the four workflows that got complicated. That is matching the tool to the job, not indecision, and we make the same argument in our post on consolidating a sales tech stack.

Where to learn n8n

• The official documentation at docs.n8n.io (checked September 2026). Unusually good for this category: every node has a page, every environment variable is listed, and the explanations of executions and the data model beat most tutorials written about them.
• n8n Academy at learn.n8n.io, described in n8n's own learning paths documentation (checked September 2026) as courses with hands-on exercises, section quizzes and a final exam, with badges and certificates at a 70 percent passing grade.
• The community forum at community.n8n.io (checked September 2026), with categories including Questions, Built with n8n, and Help me Build my Workflow. Search before you post.
• The template library at n8n.io/workflows (checked September 2026), listing 12405 workflow templates from the community. Import one, break it, read the executions log. Faster than any tutorial, because you are debugging something that already worked.

The learning order that works: build one workflow you personally need, with a Schedule Trigger and two nodes. Watch it run. Then add an IF. Then a webhook. Do not start with an AI agent orchestrating six tools, because when it misbehaves you will not have the vocabulary to find out why.

When n8n is the wrong tool

A single integration you will never touch again. If all you need is Stripe to Slack and there is a native integration, use the native integration. A workflow tool is infrastructure, and infrastructure maintained for one connection is a bad trade.

Very high volume, low complexity. Ten thousand events an hour through three steps is not a workflow problem, it is a queue and a small service.

Nobody owns it. The real failure mode. Someone builds twelve workflows, they work, that person leaves, and eight months later a token expires and nobody knows which workflow sent the invoice reminders. If you cannot name the person who will open the executions log when something goes red, write the manual process down instead.

Strict compliance requirements. If you need a named second approver before anything reaches a customer, an immutable record of what each approver saw, or certifications to hand an auditor, a workflow canvas is the wrong control. n8n can feed a system that does that, but "the automation asked me first" is not an approval process you want to describe under audit.

A fifth, less tidy: if nobody agrees what the process is, automating it makes the disagreement faster. Fix the process on paper first.

Connecting Pinlyx to n8n, step by step

Everything in this section needs the Business plan. API keys, webhooks, MCP and the Zapier app are all Business features, and on Free and Pro there is no key to create, so the credential has nothing to hold. Plans are on the pricing page. That is the one prerequisite to check before installing anything.

1. Create an API key. In the panel, Settings, then Developers, then the API Keys tab, then Create Key. Name it after the workflow that will own it, so you know what breaks the day you revoke it. Live keys start with csk_live_, the full token is shown once and never again, and afterwards the panel shows only its prefix.
2. Grant only the scopes that workflow needs. A contact writer needs contacts:read and contacts:write, a deal report needs deals:read, and conversations read on contacts:read. There are 30 scopes, and a key lacking one fails with HTTP 403 rather than appearing to work. The API scope entry explains the model.
3. Install the node. In n8n: Settings, Community Nodes, Install, then enter n8n-nodes-crmsolid and accept the risk notice. n8n notes that "Only users with the Owner or Admin role can install and manage community nodes from npm on a self-hosted n8n instance" (community node installation, checked September 2026). The package has not been through n8n's verification review, so on Cloud use the HTTP Request node against the REST API instead.
4. Create the credential. Add a Pinlyx API credential in n8n, paste the key, leave Base URL at https://api.crmsolid.com, and run the credential test. It calls /v1/me, the cheapest authenticated request there is, so a green result means key, network and scopes are all real.
5. Add the node and pick a resource. Contact (Create, Get, Get Many, Update, Delete), Deal (Create, Get Many), Conversation (Get Many). Get Many takes Return All or a limit, and paging is handled for you.
6. For inbound events, register a webhook. Tools, Integrations, Webhooks, New endpoint. There are 26 events plus webhook.test, including contact.created, contact.updated, message.received, deal.won, task.completed and invoice.paid, and * subscribes to all of them. Every event has a sample payload in the panel, so you can build the n8n side before the first real one arrives.
7. Verify the signature in n8n. Turn on Raw Body in the Webhook node options, run the raw bytes through a Crypto node set to Hmac, SHA256, HEX with the endpoint secret in its credential, and compare sha256= plus the result against {{ $json.headers['x-webhook-signature'] }} in an IF node. Sign the raw bytes, not a re-serialized object: re-stringifying JSON changes key order and whitespace, and the signature will never match. A Code node can do the same on a self-hosted instance if NODE_FUNCTION_ALLOW_BUILTIN permits the crypto module (node environment variables, checked September 2026), but the Crypto node is the portable answer.
8. Reach for the REST API for anything the node lacks. Tags, tasks, lead scores, messages and pipelines are all on /v1/* with the same bearer key. Point an HTTP Request node at them.

If you would rather an assistant decided what to do instead of a canvas following a rule you wrote last month, that is the MCP server, and MCP versus the REST API compares the three surfaces. If you want the same thing without n8n, our Zapier app covers the common triggers and actions, though it is a private app distributed by invite link rather than something in a public directory. Create a free account to look around the CRM first, then upgrade when you need the key.

Security: the eight things to get right

You are about to give a workflow engine the ability to read and write your customer records. Treat it as production.

• One key per workflow, named after the workflow. When you revoke it you will know exactly what stopped.
• Least privilege, actually applied. A digest workflow that reads conversations does not need write scopes. Scopes are enforced server side on every call, so narrowing a key is a real restriction and not a suggestion.
• Never paste a key into a node field. It belongs in an n8n credential, where it is encrypted at rest and does not travel in the workflow JSON you export or share.
• Verify every webhook signature. An unsigned endpoint is a public URL that writes to your CRM, and anyone who learns it can post whatever they like. Ours is HMAC-SHA256 over the exact bytes we sent, in X-Webhook-Signature; the HMAC signature entry covers why a constant-time comparison is worth the extra line.
• Lock the receiving end down. The Webhook node's IP(s) Allowlist limits who can invoke the URL. On our side a key can carry an IP allow list too, so a stolen key from a different address is useless.
• Make retries safe. Send an Idempotency-Key on unattended writes. Ours holds the stored response for 24 hours and replays it, so a retry cannot create a second record.
• Respect the rate limit deliberately. 60 requests a minute per key by default, with X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset on every response and Retry-After on a 429. Because the budget is per key, a looping workflow throttles itself instead of starving your other integrations. See rate limiting for the backoff pattern.
• Protect the n8n instance itself. Self-hosting means credentials for every connected service sit in one place: authentication in front of the editor, a firewall, current versions, and backups that include the encryption key. Our own posture is on the security page, and it covers the CRM side only. Your n8n box is yours.

One habit worth forming: watch the first run after you grant write scopes. A workflow's first unsupervised write should not be its first write ever.

To try it: open a free account, connect Telegram, put your contacts in, and see whether the CRM half is worth automating before you automate it. The boundary is worth being clear about, because it is the honest one: the free plan is Telegram plus the CRM core, and the n8n node, API keys, webhooks and MCP are all on the Business plan. Create a free account, no credit card needed.

Frequently asked questions

Is n8n free?

The self-hosted Community Edition is free software: you install it and n8n charges nothing, with unlimited executions as listed on its pricing page. You pay for the server and your own maintenance time. n8n Cloud is a paid subscription, listed from 20 euros a month billed annually, with a free trial that needs no card on the entry plans (n8n.io/pricing, checked September 2026).

Some features are excluded from the free edition, including SSO, RBAC, environments and log streaming. Registering your email unlocks folders, debug in editor and custom execution data at no cost.

Is n8n open source?

Not in the strict sense, and n8n does not claim it is. The source is public on GitHub and the license is the Sustainable Use License, which states: "You may use or modify the software only for your own internal business purposes or for non-commercial or personal use." n8n calls this fair-code. Files marked .ee. are under a separate Enterprise License.

Practically: automating your own company is free, reselling a hosted n8n is not, and agencies delivering client work should read the license and ask n8n rather than a blog.

Is n8n better than Zapier?

Not better, different. n8n wins on branching logic, self-hosting, a code escape hatch and per-execution billing that rewards complex workflows. Zapier wins on setup speed, breadth of app coverage and the fact that nobody has to maintain anything.

The deciding question is who maintains it. If that person enjoys a terminal, n8n. If the answer is "whoever is free that week", Zapier.

Do I need to know how to code to use n8n?

No for the first month, and a little helps after that. Dragging nodes and mapping fields requires no code. What you will meet is the expression syntax, {{ $json.fieldName }}, which is copy-and-adjust rather than programming.

The Code node exists for when a transformation gets awkward, and plenty of people run twenty workflows without opening it. The real prerequisite is reading a JSON payload and seeing which key holds the email address.

Can n8n run AI agents?

Yes. The AI Agent node is a root node you attach sub-nodes to: "Connect a chat model and one or more tools, and the agent decides which tools to call to complete a task" (AI Agent node documentation, checked September 2026). You supply the model provider account, so LLM usage is billed by that provider, not by n8n.

Use it for judgment: classification, extraction and drafting. Keep deterministic decisions in IF nodes, and keep a human in front of anything that spends money or messages a customer.

How do I connect a CRM to n8n?

Three ways, in increasing order of effort and capability. A dedicated node if the CRM publishes one, installed from Settings then Community Nodes. Outbound webhooks from the CRM into an n8n Webhook node, which is push instead of poll and fires in seconds. Or the HTTP Request node against the CRM's REST API, which reaches everything the other two do not.

For ours: install n8n-nodes-crmsolid, create a Pinlyx API credential with a csk_live_ key, and you get Contact, Deal and Conversation operations. The API and MCP integration guide walks through the key, the first request and signature verification. It needs the Business plan.

Is self-hosted n8n secure?

As secure as you make it, which is the honest answer for any self-hosted software. The advantages are real: your data stays on your machine, credentials never leave your network, and you choose the jurisdiction. The responsibility is equally real, because every credential for every connected service now sits in one container.

The baseline: authentication in front of the editor, TLS, a firewall that exposes only the proxy, current versions, and backups that include the encryption key. Skip the last one and a restore gives you workflows that cannot authenticate to anything.

What does n8n do, and what is it used for?

Moving data between systems that do not talk to each other, on a trigger or a schedule. In small businesses the recurring jobs are: form submissions into a CRM, order events into customer records, scheduled reports and digests, alerting a team chat when something important happens, syncing two tools that hold the same customer, and enriching records from a third-party API.

Larger teams add data pipelines, approval flows and AI agents with tool access. The pattern is constant: a trigger, a few transformations, and a write into somewhere a human will look.

How many integrations does n8n have?

Its integrations page states 2188 integrations (n8n.io/integrations, checked September 2026); Zapier's directory states "10118+ apps" (zapier.com/apps, checked September 2026). Compare with care: every vendor counts differently, the total is irrelevant if your tool is missing, and the HTTP Request node means anything with an API is reachable whether or not it has a node.

Does the Pinlyx n8n node work on n8n Cloud?

Not by installing the npm package. n8n Cloud offers community nodes that n8n has reviewed and verified, and this package has not been through that review. On self-hosted instances you can install any published package from Settings, then Community Nodes.

On Cloud the same operations are available through the HTTP Request node pointed at https://api.crmsolid.com/v1 with the same bearer key. More configuration, identical behavior, and better said here than discovered after you sign up.

Related reading

• MCP server for social media: the other way to connect a CRM to an AI tool, where the model is in control instead of a canvas.
• AI agents versus chatbots: what changes when the thing answering your customers can call tools.
• Consolidating a sales tech stack: how to decide which tools to keep before you wire them together.
• How to choose a CRM in 2026: the evaluation checklist, including the API questions most buyers skip.
• Integrations and contacts CRM: what a workflow writes into and the fields it can reach. Deals covers the pipeline behind the deal operations.