---
title: Publish the n8n node and get it verified
description: Release n8n-nodes-veefore to npm with provenance from a public repository, and submit it for n8n Cloud verification.
---
This is the maintainer's procedure for releasing `n8n-nodes-veefore` and making
it installable on n8n Cloud. You need: the public GitHub repository for the
node, an npmjs.com account, and an n8n Creator Portal account.

:::note Why each requirement exists
n8n Cloud installs only verified nodes. Since 1 May 2026 n8n verifies only
packages published to npm **from GitHub Actions with a provenance statement**,
and npm generates provenance only for a **public** repository. n8n's linter
also expects the **MIT** license for verified nodes. The node package is MIT;
the rest of Veefore keeps its own license.
:::

## What the package already meets

| Requirement | Where |
| --- | --- |
| Name starts `n8n-nodes-` | `n8n-nodes-veefore` |
| Keyword `n8n-community-node-package` | `package.json` |
| Nodes and credentials under `n8n` in `package.json` | `dist/nodes/Veefore/Veefore.node.js`, `dist/credentials/VeeforeApi.credentials.js` |
| No runtime dependencies; only `n8n-workflow` and `node:crypto` | `package.json` |
| Built and linted with `@n8n/node-cli` (0.23 or later) | `npm run build`, `npm run lint` (clean) |
| README in the package | `README.md` |
| MIT license | `LICENSE` |
| GitHub Actions publish with provenance | `.github/workflows/publish.yml` |
| Light and dark icons | `nodes/Veefore/veefore{,.dark}.svg` |

## Step by step

:::steps
:::step Copy the package into the public repository
Copy everything in `integrations/n8n-nodes-veefore/` of the Veefore repository
into the **root** of the public repository, including `.github/`, `LICENSE`,
`package-lock.json` and `eslint.config.mjs`. Leave out `node_modules/` and
`dist/`.
```bash
rsync -a --exclude node_modules --exclude dist \
  integrations/n8n-nodes-veefore/ ../n8n-nodes-veefore/
cd ../n8n-nodes-veefore
```
Set `repository.url` in `package.json` to the public repository, then commit
and push.
:::
:::step Check it locally
```bash
npm ci --ignore-scripts
npm run lint
npm run build
npm pack --dry-run
```
`lint` must report no problems. `pack` lists `dist/`, `LICENSE`, `README.md`
and `package.json`.
:::
:::step Connect npm to the repository
On [npmjs.com](https://www.npmjs.com), sign in. Choose one:

- **Trusted publishing (recommended, no secret).** If the package exists:
  **n8n-nodes-veefore → Settings → Publish access → Trusted Publishers → Add →
  GitHub Actions**, with your organization, the repository name and workflow
  `publish.yml`.
- **Token (needed for the very first publish if npm will not add a trusted
  publisher to a package that does not exist yet).** **Access Tokens →
  Generate → Granular Access Token**, read and write, limited to
  `n8n-nodes-veefore` (or all packages for the first publish, then narrow it).
  In GitHub: **Settings → Secrets and variables → Actions → New secret**,
  name `NPM_TOKEN`. After the first release, switch to trusted publishing and
  delete the secret.
:::
:::step Release
In the public repository:
```bash
npm run release
```
It lints, builds, asks for the version (start with `1.0.0`), updates the
changelog, commits, tags and pushes. The tag starts the **Publish** workflow.
Watch it under **Actions**; it ends with the package on npm.
:::
:::step Confirm provenance and scan it
On the package's npm page, a **Provenance** section links to the workflow run
and commit. Then:
```bash
npx @n8n/scan-community-package n8n-nodes-veefore
```
It must pass. This is the same check n8n runs first.
:::
:::step Submit for verification
Sign in at [creators.n8n.io](https://creators.n8n.io), submit
`n8n-nodes-veefore`, and give a short description: *"Runs actions from
workflows and AI agents through Veefore's policy, approval and credential
broker."* n8n reviews it against its technical and UX guidelines. Reviews can
take several weeks; the portal shows the status.
:::
:::step After approval
The node appears in the n8n Cloud nodes panel as **Veefore**. Update
[n8n Cloud](/build/n8n-cloud) to send users to it, and keep the MCP route as an
alternative.
:::
:::

## Releasing an update

Change the code in the Veefore repository, run the live test
(`scripts/smoke-n8n-live.ts`) against a real n8n, copy the package to the public
repository again, and `npm run release`. Every version must come from the
workflow; a version published from a laptop has no provenance and n8n will not
accept it.

## If n8n rejects it

| Message | Usual cause |
| --- | --- |
| "Some tests have failed" | Run `npx @n8n/scan-community-package n8n-nodes-veefore` and fix what it lists. |
| Missing provenance | The version was published from a laptop, or the repository was private. Publish a new version from the workflow. |
| License | `package.json` must say `MIT` and `LICENSE` must be in the package. |
| Runtime dependency | Nothing may be listed under `dependencies`. |
| "Missing credential test" | The credential type needs its own `test` request. `VeeforeApi` signs an assertion in `preAuthentication`, stores the session token in a hidden expirable field, and tests with an authenticated `GET /gateway/v1/tools`. A node-level `testedBy` method does not count. |