@ixiam/n8n-nodes-civicrm 2.1.8 → 3.0.0

package/README.md

@@ -40,14 +40,119 @@ Download: https://civicrm.org/download
 
 ## 🔐 Credentials
 
-The node uses **Bearer Token Authentication**.
+The node supports two authentication modes:
+
+### **1. Standard API Key Authentication**
+Simple and reliable for most use cases.
+
+| Field | Description |
+|-------|-------------|
+| **Base URL** | Root URL of CiviCRM. Example: `https://crm.example.org` |
+| **API Token** | Your API Key from CiviCRM (sent as `X-Civi-Auth: Bearer <token>`) |
+
+### **2. JWT Authentication with Auto-Resolve (v3.0+)**
+Time-bounded tokens for enhanced security. **Contact ID is automatically resolved** from your API Key.
 
 | Field | Description |
 |-------|-------------|
-| **Base URL** | The root URL of your CiviCRM instance (without trailing slash). Example: `https://crm.example.org` |
-| **API Token** | Sent as header `X-Civi-Auth: Bearer <token>` |
+| **Base URL** | Root URL of CiviCRM |
+| **API Token** | Your API Key (used to resolve Contact ID & generate JWT) |
+| **Enable JWT Auth** | Toggle to enable time-bounded JWT tokens |
+| **JWT Header Mode** | Where to send JWT (X-Civi-Auth recommended) |
+
+#### How JWT Auto-Resolve Works
+
+1. When making an API call, the node automatically:
+   - Resolves your Contact ID from your API Key
+   - Generates a time-bounded JWT token (1 hour default)
+   - Caches both for efficiency
+
+2. The JWT is used for API requests, with **automatic fallback to API Key** if:
+   - JWT generation fails
+   - JWT returns empty results
+   - JWT expires
+
+3. **Zero manual configuration** - Contact ID is detected automatically
+
+> **Note on warnings vs. results:** When JWT auth is enabled but the token can't be obtained (e.g. AuthX disabled or misconfigured on the CiviCRM side), the node still returns data — it silently retries the same request with the API Key. You'll see a **warning in the node's output pane** explaining why JWT wasn't used, but the workflow does not fail and the query results are still shown. This is intentional: JWT failures never break a workflow, they only fall back to API Key auth and surface a non-blocking warning.
+
+#### JWT Setup Requirements
+
+**CiviCRM Extensions & Settings:**
+- ✓ AuthX extension enabled (CiviCRM 5.48+)
+- ✓ API Key assigned to a Contact record
+
+**CiviCRM Authentication Configuration**
+
+The following settings must be enabled in CiviCRM's Authentication configuration:
+
+```
+Administer → System Settings → Authentication
+├─ AuthX Header Authentication: ✓ ENABLED
+├─ AuthX XHeader Support: ✓ ENABLED
+├─ Credential Types: Include 'jwt'
+└─ XHeader Name: Set to 'X-Civi-Auth' (default)
+```
 
-After entering credentials, click **Save** to validate the connection.
+**Settings in civicrm.settings.php:**
+```php
+// Enable AuthX for JWT tokens
+define('CIVICRM_AUTHX_XHEADER_CRED', json_encode(['jwt']));
+
+// Optional: Configure JWT signing keys (auto-generated)
+// define('CIVICRM_AUTHX_SIGN_KEY', 'your-signing-key');
+```
+
+**How to Enable:**
+1. Go to **Administer → System Settings → Authentication**
+2. Find **AuthX Settings** section
+3. Check: `✓ Enable X-Header Authentication`
+4. Check: `✓ JWT in X-Civi-Auth header`
+5. Verify **Header name**: `X-Civi-Auth`
+6. **Save** configuration
+
+#### JWT Token Rotation & Security
+
+**Token Lifetime & Auto-Refresh:**
+- JWT tokens auto-expire after 1 hour (configurable in n8n credential)
+- n8n automatically refreshes expired tokens (transparent to workflows)
+- No manual intervention needed
+
+**Security Best Practices:**
+
+| Action | Frequency | Reason |
+|--------|-----------|--------|
+| **Rotate API Keys** | Every 90 days | Limits exposure window if compromised |
+| **Review AuthX Logs** | Monthly | Detect unauthorized access attempts |
+| **Monitor JWT Usage** | Real-time | Alert on unusual patterns |
+| **Update CiviCRM** | As released | Includes security patches |
+| **Audit n8n Workflows** | Quarterly | Verify only needed credentials used |
+
+**When to Regenerate Credentials:**
+- ✅ Regular security rotation (quarterly)
+- ✅ Suspected credential compromise
+- ✅ Staff member leaves organization
+- ✅ n8n instance compromised
+- ✅ Failed authentication attempts detected
+
+**How to Revoke Access Immediately:**
+```
+Option 1: Disable JWT (n8n credential)
+├─ Uncheck "Enable JWT Auth" toggle
+└─ Node falls back to API Key (effective immediately)
+
+Option 2: Regenerate API Key (CiviCRM)
+├─ Go to Contact record
+├─ Regenerate API Key field
+└─ Old JWT & API Key become invalid instantly
+```
+
+**→ See [JWT_QUICKSTART.md](JWT_QUICKSTART.md) for 5-minute setup**  
+**→ See [JWT_AUTORESOLVE_SETUP.md](JWT_AUTORESOLVE_SETUP.md) for detailed configuration**
+
+---
+
+After entering credentials, click **Test credentials** to validate the connection.
 
 ---
 
@@ -128,13 +233,46 @@ Example:
 }
 ```
 
+### **7. JWT Authentication with Auto-Resolve (v3.0+)**
+Enhanced security with time-bounded tokens:
+
+**Features:**
+- ✨ **Automatic Contact ID Resolution** - No manual input needed
+- ✨ **Time-Bounded Tokens** - 1 hour default (configurable)
+- ✨ **Smart Fallback** - Automatically falls back to API Key if JWT insufficient
+- ✨ **Efficient Caching** - Contact ID & JWT cached for performance
+- ✨ **Zero Configuration** - Just enable "JWT Auth" toggle
+
+**Example Workflow:**
+```
+Enable JWT in credential
+    ↓
+Make API call
+    ↓
+[Automatic]
+├─ Resolve: Which Contact owns this API Key?
+├─ Generate: Time-bounded JWT token
+├─ Try: API call with JWT
+└─ Fallback: If empty, retry with API Key
+    ↓
+Get results
+```
+
+**Security Benefits vs API Key Only:**
+- ✓ Tokens expire automatically (1 hour)
+- ✓ Leaked token has limited lifetime
+- ✓ Can't be used outside CiviCRM
+- ✓ Full audit trail available
+
+→ **Learn more:** [JWT_AUTORESOLVE_SETUP.md](JWT_AUTORESOLVE_SETUP.md)
+
 ---
 
 ## Compatibility
 
 - **n8n version:** 1.0.0 or higher  
 - **Node.js:** 18 or higher  
-- **CiviCRM:** API v4 compatible (including Civi-Go)
+- **CiviCRM:** API v4 compatible 
 
 ---
 

package/dist/credentials/CiviCrmApi.credentials.js

@@ -26,15 +26,62 @@ class CiviCrmApi {
                 default: '',
                 required: true,
             },
-        ];
-        this.authenticate = {
-            type: 'generic',
-            properties: {
-                headers: {
-                    'X-Civi-Auth': '={{ "Bearer " + $credentials.apiToken }}',
+            {
+                displayName: 'Enable JWT Authentication',
+                name: 'enableJwtAuth',
+                type: 'boolean',
+                default: false,
+                description: 'Enable server-issued JWT authentication for improved security (time-bound tokens, auto-resolved contact ID). When disabled, uses API key authentication.',
+            },
+            {
+                displayName: 'JWT Header Mode',
+                name: 'jwtHeaderMode',
+                type: 'options',
+                default: 'xheader',
+                displayOptions: {
+                    show: {
+                        enableJwtAuth: [true],
+                    },
                 },
+                options: [
+                    {
+                        name: 'X-Civi-Auth Header (Recommended)',
+                        value: 'xheader',
+                    },
+                    {
+                        name: 'Authorization Header',
+                        value: 'authorization',
+                    },
+                    {
+                        name: 'Both Headers',
+                        value: 'both',
+                    },
+                ],
+                description: 'Where to send the JWT token.',
             },
-        };
+            {
+                displayName: 'JWT Expiry (Seconds)',
+                name: 'jwtExpiry',
+                type: 'number',
+                default: 3600,
+                typeOptions: {
+                    minValue: 60,
+                    maxValue: 86400,
+                },
+                displayOptions: {
+                    show: {
+                        enableJwtAuth: [true],
+                    },
+                },
+                description: 'Lifetime of the server-issued JWT, in seconds, before it must be renewed. Default is 3600 (1 hour).',
+            },
+        ];
+        // n8n's CredentialsTester always prefers a `test` defined directly here over the
+        // CiviCrm node's `testedBy: 'testCiviCrmApiConnection'` (see CiviCrm.node.ts), so
+        // that JWT-aware test never actually runs while this declarative test exists.
+        // It's kept as a plain API-key connectivity check so "Test credentials" always
+        // works reliably; the node's execution path (addExecutionHints) is what surfaces
+        // JWT-specific failures instead.
         this.test = {
             request: {
                 baseURL: '={{$credentials.baseUrl}}',
@@ -42,6 +89,7 @@ class CiviCrmApi {
                 method: 'POST',
                 headers: {
                     'Content-Type': 'application/x-www-form-urlencoded',
+                    'X-Civi-Auth': '={{ "Bearer " + $credentials.apiToken }}',
                 },
                 body: {
                     params: JSON.stringify({ select: ['id'], limit: 1 }),

package/dist/src/nodes/CiviCrm/CiviCrm.node.js

@@ -574,13 +574,13 @@ class CiviCrm {
         this.methods = {
             loadOptions: {
                 async loadOptionValues() {
-                    const { baseUrl } = (await this.getCredentials('civiCrmApi'));
-                    const res = await this.helpers.httpRequestWithAuthentication.call(this, 'civiCrmApi', {
+                    const credentials = (await this.getCredentials('civiCrmApi'));
+                    const baseUrl = credentials.baseUrl.replace(/\/$/, '');
+                    const headers = (0, GenericFunctions_1.buildCiviAuthHeaders)(credentials, baseUrl);
+                    const res = await this.helpers.httpRequest.call(this, {
                         method: 'POST',
-                        url: `${baseUrl.replace(/\/$/, '')}/civicrm/ajax/api4/OptionValue/get`,
-                        headers: {
-                            'Content-Type': 'application/x-www-form-urlencoded',
-                        },
+                        url: `${baseUrl}/civicrm/ajax/api4/OptionValue/get`,
+                        headers,
                         body: { params: JSON.stringify({ limit: 50, select: ['id', 'label'] }) },
                         json: true,
                     });

package/dist/src/nodes/transport/GenericFunctions.js

@@ -1,36 +1,176 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCiviAuthHeaders = buildCiviAuthHeaders;
 exports.civicrmApiRequest = civicrmApiRequest;
 exports.api4 = api4;
 const n8n_workflow_1 = require("n8n-workflow");
+const JwtAuth_1 = require("./JwtAuth");
+function getJwtHeaderMode(credentials) {
+    var _a;
+    const rawMode = String((_a = credentials.jwtHeaderMode) !== null && _a !== void 0 ? _a : 'xheader');
+    if (rawMode === 'authorization' || rawMode === 'xheader' || rawMode === 'both') {
+        return rawMode;
+    }
+    return 'xheader';
+}
+function applyJwtHeaders(headers, jwtToken, headerMode) {
+    const bearer = `Bearer ${jwtToken}`;
+    if (headerMode === 'both' || headerMode === 'authorization') {
+        headers.Authorization = bearer;
+    }
+    if (headerMode === 'both' || headerMode === 'xheader') {
+        headers['X-Civi-Auth'] = bearer;
+    }
+}
+function getHttpErrorDetails(error) {
+    var _a, _b, _c;
+    const errorObj = error;
+    const status = (_a = errorObj === null || errorObj === void 0 ? void 0 : errorObj.response) === null || _a === void 0 ? void 0 : _a.status;
+    const data = (_b = errorObj === null || errorObj === void 0 ? void 0 : errorObj.response) === null || _b === void 0 ? void 0 : _b.data;
+    const message = (_c = errorObj === null || errorObj === void 0 ? void 0 : errorObj.message) !== null && _c !== void 0 ? _c : 'Request rejected by CiviCRM';
+    if (typeof data === 'string' && data.trim()) {
+        return status ? `${message} | HTTP ${status} body: ${data}` : `${message} | body: ${data}`;
+    }
+    if (data && typeof data === 'object') {
+        const serialized = JSON.stringify(data);
+        return status ? `${message} | HTTP ${status} body: ${serialized}` : `${message} | body: ${serialized}`;
+    }
+    return status ? `${message} | HTTP ${status}` : message;
+}
+function buildCiviAuthHeaders(credentials, baseUrl, jwtToken) {
+    const headers = {
+        'Content-Type': 'application/x-www-form-urlencoded',
+    };
+    // Use JWT if available and enabled; otherwise always fall back to API key
+    if (jwtToken && (0, JwtAuth_1.isJwtAuthEnabled)(credentials)) {
+        const headerMode = getJwtHeaderMode(credentials);
+        applyJwtHeaders(headers, jwtToken, headerMode);
+    }
+    else {
+        // Always provide API key as fallback
+        headers['X-Civi-Auth'] = `Bearer ${credentials.apiToken}`;
+    }
+    return headers;
+}
 /**
- * Executes a CiviCRM API v4 call (Civi-Go).
- * Uses form-urlencoded encoding with the "params" field serialized as JSON.
+ * Executes a CiviCRM API v4 call with authentication (JWT or API Key).
+ * Falls back to API Key if JWT is unavailable, fails, or returns empty results.
  */
 async function civicrmApiRequest(method, path, body) {
-    var _a;
-    const credentials = await this.getCredentials('civiCrmApi');
+    var _a, _b, _c;
+    const credentials = (await this.getCredentials('civiCrmApi'));
     const baseUrl = credentials.baseUrl.replace(/\/$/, '');
-    const options = {
+    const apiToken = credentials.apiToken;
+    let jwtToken;
+    let useJwt = false;
+    // Attempt to obtain JWT if enabled
+    if ((0, JwtAuth_1.isJwtAuthEnabled)(credentials)) {
+        const ttl = Number((_a = credentials.jwtExpiry) !== null && _a !== void 0 ? _a : 3600);
+        try {
+            // Auto-resolve contact ID is built-in to getServerIssuedJwt
+            jwtToken = await (0, JwtAuth_1.getServerIssuedJwt)(this, baseUrl, apiToken, 0, ttl);
+            if (jwtToken) {
+                useJwt = true;
+            }
+            else {
+                console.warn('[CiviCRM] JWT generation returned no token, falling back to API key');
+                this.addExecutionHints({
+                    message: 'JWT authentication could not be obtained (no token returned by CiviCRM). Falling back to API Key authentication.',
+                    type: 'warning',
+                    location: 'outputPane',
+                });
+            }
+        }
+        catch (error) {
+            const errorMsg = getHttpErrorDetails(error);
+            console.warn(`[CiviCRM] JWT generation failed: ${errorMsg}. Falling back to API key.`);
+            this.addExecutionHints({
+                message: `JWT authentication failed (${errorMsg}). Falling back to API Key authentication.`,
+                type: 'warning',
+                location: 'outputPane',
+            });
+        }
+    }
+    // Try with JWT first (if available)
+    if (useJwt && jwtToken) {
+        const headers = buildCiviAuthHeaders(credentials, baseUrl, jwtToken);
+        const options = {
+            method,
+            url: `${baseUrl}${path}`,
+            headers,
+            body: {
+                params: JSON.stringify((_b = body.params) !== null && _b !== void 0 ? _b : body),
+            },
+            json: true,
+        };
+        try {
+            const response = await this.helpers.httpRequest.call(this, options);
+            // Check if response has data. If JWT returned empty but we expected data, fallback to API key
+            const hasData = hasResponseData(response);
+            if (hasData) {
+                return response;
+            }
+            else {
+                console.warn('[CiviCRM] JWT returned empty response. Retrying with API key (JWT may have limited permissions).');
+                this.addExecutionHints({
+                    message: 'The JWT-authenticated request returned no data (JWT may have limited permissions). Retrying with API Key authentication.',
+                    type: 'warning',
+                    location: 'outputPane',
+                });
+                // Fall through to API key attempt below
+            }
+        }
+        catch (error) {
+            const errorMsg = getHttpErrorDetails(error);
+            console.warn('[CiviCRM] JWT request failed. Retrying with API key.');
+            this.addExecutionHints({
+                message: `The JWT-authenticated request failed (${errorMsg}). Retrying with API Key authentication.`,
+                type: 'warning',
+                location: 'outputPane',
+            });
+            // Fall through to API key attempt below
+        }
+    }
+    // Fallback to API Key
+    const apiKeyHeaders = buildCiviAuthHeaders(credentials, baseUrl, undefined);
+    const apiKeyOptions = {
         method,
         url: `${baseUrl}${path}`,
-        headers: {
-            'Content-Type': 'application/x-www-form-urlencoded',
-        },
-        // flat body as expected by Civi-Go
+        headers: apiKeyHeaders,
         body: {
-            params: JSON.stringify((_a = body.params) !== null && _a !== void 0 ? _a : body),
+            params: JSON.stringify((_c = body.params) !== null && _c !== void 0 ? _c : body),
         },
         json: true,
     };
     try {
-        const response = await this.helpers.httpRequestWithAuthentication.call(this, 'civiCrmApi', options);
+        const response = await this.helpers.httpRequest.call(this, apiKeyOptions);
+        if (useJwt && jwtToken) {
+            console.log('[CiviCRM] API key request successful (JWT was insufficient, using API key as fallback)');
+        }
         return response;
     }
     catch (error) {
         throw new n8n_workflow_1.NodeApiError(this.getNode(), error);
     }
 }
+/**
+ * Check if API response contains actual data.
+ * Returns false if response is empty/no results, true if has data.
+ */
+function hasResponseData(response) {
+    if (!response)
+        return false;
+    // Check for APIv4 response format: { values: [...], count: N }
+    if (response.values !== undefined) {
+        return Array.isArray(response.values) && response.values.length > 0;
+    }
+    // Check for other formats
+    if (Array.isArray(response)) {
+        return response.length > 0;
+    }
+    // If response exists and isn't an empty array, consider it has data
+    return Object.keys(response).length > 0;
+}
 /**
  * Returns the standard body for API4 calls (flat params).
  */

package/dist/src/nodes/transport/JwtAuth.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isJwtAuthEnabled = isJwtAuthEnabled;
+exports.resolveContactId = resolveContactId;
+exports.getServerIssuedJwt = getServerIssuedJwt;
+const serverIssuedCache = {};
+const contactIdCache = {}; // Cache resolved contact IDs
+function isJwtAuthEnabled(credentials) {
+    return (credentials === null || credentials === void 0 ? void 0 : credentials.enableJwtAuth) === true;
+}
+/**
+ * Extracts a readable message from an HTTP error, including the response body
+ * (e.g. CiviCRM's "Login not permitted. Must satisfy guard (perm, site_key)."),
+ * which the bare `error.message` (e.g. "Request failed with status code 401")
+ * does not include.
+ */
+function getErrorDetails(error) {
+    var _a, _b, _c;
+    const errorObj = error;
+    const status = (_a = errorObj === null || errorObj === void 0 ? void 0 : errorObj.response) === null || _a === void 0 ? void 0 : _a.status;
+    const data = (_b = errorObj === null || errorObj === void 0 ? void 0 : errorObj.response) === null || _b === void 0 ? void 0 : _b.data;
+    const message = (_c = errorObj === null || errorObj === void 0 ? void 0 : errorObj.message) !== null && _c !== void 0 ? _c : String(error);
+    const body = typeof data === 'string' && data.trim()
+        ? data
+        : data && typeof data === 'object'
+            ? JSON.stringify(data)
+            : undefined;
+    if (body) {
+        return status ? `${message} | HTTP ${status} body: ${body}` : `${message} | body: ${body}`;
+    }
+    return status ? `${message} | HTTP ${status}` : message;
+}
+/**
+ * Resolve the current authenticated user's contact ID from Contact/get.
+ * Finds the contact that owns the given api_key.
+ * Cached to avoid repeated lookups.
+ * Returns undefined if resolution fails (allowing caller to handle gracefully).
+ */
+async function resolveContactId(context, baseUrl, apiToken) {
+    const cacheKey = `${baseUrl}:${apiToken}`;
+    if (contactIdCache[cacheKey]) {
+        return contactIdCache[cacheKey];
+    }
+    try {
+        const response = await context.helpers.httpRequest.call(context, {
+            method: 'POST',
+            url: `${baseUrl}/civicrm/ajax/api4/Contact/get`,
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'X-Civi-Auth': `Bearer ${apiToken}`,
+            },
+            body: {
+                params: JSON.stringify({
+                    select: ['id'],
+                    where: [['api_key', '=', apiToken]],
+                    limit: 1,
+                }),
+            },
+            json: true,
+        });
+        const contacts = (response === null || response === void 0 ? void 0 : response.values) || [];
+        if (contacts.length === 0) {
+            console.warn('[CiviCRM] Contact/get found no contact with this api_key - JWT auto-resolve will be skipped');
+            return undefined;
+        }
+        const contactId = contacts[0].id;
+        contactIdCache[cacheKey] = contactId;
+        return contactId;
+    }
+    catch (error) {
+        const errorMsg = getErrorDetails(error);
+        console.warn(`[CiviCRM] Failed to auto-resolve contact ID: ${errorMsg}. Will attempt API key fallback.`);
+        return undefined;
+    }
+}
+/**
+ * Fetch JWT from CiviCRM AuthxCredential/create using API key.
+ * If contactId is 0 or undefined, automatically resolves it from Contact/get.
+ * CiviCRM signs and issues the JWT, guaranteeing AuthX compatibility.
+ * Returns undefined if JWT generation fails or permission denied, allowing fallback to API key.
+ */
+async function getServerIssuedJwt(context, baseUrl, apiToken, contactId = 0, ttl = 3600) {
+    var _a, _b;
+    // Auto-resolve contact ID if not provided
+    let resolvedContactId = contactId;
+    if (resolvedContactId === 0 || resolvedContactId === undefined) {
+        const resolved = await resolveContactId(context, baseUrl, apiToken);
+        if (!resolved) {
+            // Auto-resolve failed, can't generate JWT
+            return undefined;
+        }
+        resolvedContactId = resolved;
+    }
+    const cacheKey = `${baseUrl}:${resolvedContactId}:${ttl}`;
+    const now = Date.now();
+    const cached = serverIssuedCache[cacheKey];
+    // Return cached token if still valid (with 30s buffer)
+    if (cached && cached.expiresAt > now + 30000) {
+        return cached.token;
+    }
+    try {
+        const response = await context.helpers.httpRequest.call(context, {
+            method: 'POST',
+            url: `${baseUrl}/civicrm/ajax/api4/AuthxCredential/create`,
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'X-Civi-Auth': `Bearer ${apiToken}`,
+            },
+            body: {
+                params: JSON.stringify({
+                    contactId: resolvedContactId,
+                    ttl: ttl,
+                }),
+            },
+            json: true,
+        });
+        const cred = ((_b = (_a = response === null || response === void 0 ? void 0 : response.values) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.cred) || '';
+        if (!cred.startsWith('Bearer ')) {
+            console.warn('[CiviCRM] Invalid JWT response: missing Bearer token');
+            return undefined;
+        }
+        const token = cred.substring(7); // Remove "Bearer " prefix
+        serverIssuedCache[cacheKey] = { token, expiresAt: now + ttl * 1000 };
+        return token;
+    }
+    catch (error) {
+        const errorMsg = getErrorDetails(error);
+        const isPermissionDenied = errorMsg.includes('Authorization failed') ||
+            errorMsg.includes('403') ||
+            errorMsg.includes('Permission denied') ||
+            errorMsg.includes('Login not permitted') ||
+            errorMsg.includes('Must satisfy guard');
+        if (isPermissionDenied) {
+            // User lacks permissions for JWT. Fall back to API key auth.
+            console.warn(`[CiviCRM JWT] User lacks permissions for AuthxCredential/create (${errorMsg}). Will use API key authentication instead.`);
+            return undefined;
+        }
+        console.warn(`[CiviCRM JWT] Failed to obtain JWT: ${errorMsg}. Falling back to API key.`);
+        return undefined;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ixiam/n8n-nodes-civicrm",
-  "version": "2.1.8",
+  "version": "3.0.0",
   "description": "Full-featured CiviCRM API v4 integration for n8n",
   "license": "MIT",
   "keywords": [
@@ -50,12 +50,16 @@
   },
   "devDependencies": {
     "@n8n/node-cli": "^0.23.1",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^20.11.30",
     "eslint": "9.32.0",
     "prettier": "3.6.2",
     "release-it": "^19.0.6",
     "typescript": "5.9.2"
   },
+  "dependencies": {
+    "jsonwebtoken": "^9.0.3"
+  },
   "peerDependencies": {
     "n8n-workflow": "*"
   },