n8n nightly sweep, machine identity

A scheduled workflow that flags stale loans. Registered in Descope as a machine identity — authenticates via client_credentials, secrets live in the Connections vault.

DocsClients ↗Connections ↗Policies ↗

Section 2 · Agent outbound auth

Agents authenticate to Descope and receive scoped tokens. Policies fire at issuance. Downstream credentials are fetched from the Connections Vault — never stored in agent code.

Step 2 — machine identity uses client_credentials to get a JWT; can request a Descope Resource token directly, or exchange the m2m JWT for Connections API keys.

Token acquisition / resource token

Connections token → downstream credential

n8n·northwind / nightly-stale-loans

last ran 02:00 UTC · 28 records

Schedule trigger
Cron
Fetch stale loans · HubSpot
HTTP
Descope vault · client_credentials
Enrich borrower · external API
HTTP
Descope vault · ek_l…uM91
Flag risky loans · Slack #risk-ops
Slack
Descope vault · OAuth

n8n node config — for the curious

{
  "name": "Fetch stale loans",
  "type": "n8n-nodes-base.httpRequest",
  "credentials": {
    "descopeConnection": "hubspot-client-credentials"
  }
}
// No client_id, no client_secret, no API key.
// The Descope node resolves the credential at run time.

Descope Console·Connections / Vault

Stored credentials

2 entries

HubSpotOAuth
scope: hubspot:read·for machine client_n8nBatch…7p2m
issued 12m ago
expires in 48m
Enrichment API (clearbit-style)API key
scope: ek_l…uM91·for machine client_n8nBatch…7p2m
issued 12 days ago
expires no expiry

Operate

Each action runs against the mock state — no real services are called.