Crypto Connector

What this connector is for

Hashes strings (one-way, optionally as HMAC) and encrypts/decrypts data (two-way, symmetric) using Node's built-in crypto module. No connection is needed — secrets are supplied per-step, ideally from a workflow variable rather than typed directly into the step.

Hash String

Produces a one-way hash of a string, or an HMAC if a secret is supplied. A hash (with or without a secret) can't be reversed back to the original input.

Configuring it

• Input String — required. The string to hash.
• Hash Algorithm — required, one of sha256, sha512, sha1, md5, sha384, sha224, sha3-256, sha3-512. Defaults to sha256. sha256/sha512 are recommended; md5/sha1 are offered for compatibility with systems that require them, not for anything where collision resistance matters.
• Output Encoding — hex (default), base64, or base64url.
• Secret Key (HMAC) — optional. If set (and non-blank), the result is an HMAC (crypto.createHmac) keyed with this secret instead of a plain hash — use this when the receiving system needs to verify the hash came from someone who knows the secret, not just that the input matches.

Reading the response

• {{<stepReference>.response.data.hash}} — the hash or HMAC output.
• {{<stepReference>.response.data.algorithm}} — the algorithm used.
• {{<stepReference>.response.data.encoding}} — the output encoding used.
• {{<stepReference>.response.data.isHmac}} — whether a Secret Key was supplied.

For example, a step named "Hash Webhook Payload" (reference hashWebhookPayload) — use {{hashWebhookPayload.response.data.hash}}.

Example

Input String: {{trigger.body}}
Hash Algorithm: sha256
Secret Key: {{variables.webhookSigningSecret}}

Encrypt Data

Encrypts a string or JSON object with AES in CBC mode.

Configuring it

• Data to Encrypt — required. A string or a JSON object (an object is stringified first).
• Secret Key — required, at least 16 characters. This is not used directly as the AES key — it's hashed once with SHA-256 and truncated to the algorithm's required key length. Because that's a fast hash rather than a purpose-built password KDF (no salt, no iteration count), a short or guessable Secret Key is comparatively easy to brute-force offline — use a long, random secret (e.g. generated and stored as a workflow variable), not a memorable passphrase.
• Encryption Algorithm — aes-256-cbc (default), aes-192-cbc, or aes-128-cbc.
• Output Encoding — base64 (default), hex, or base64url.

Note: AES-CBC provides confidentiality only — it has no built-in integrity/authenticity check, so it doesn't by itself detect a tampered ciphertext. Don't rely on this action to prove data hasn't been altered; pair it with a separate HMAC (via Hash String, above) if that guarantee matters for your use case.

Reading the response

• {{<stepReference>.response.data.encrypted}} — the ciphertext.
• {{<stepReference>.response.data.iv}} — the randomly generated Initialization Vector for this call. It isn't secret, but it is required to decrypt — store or forward it alongside the ciphertext, encoded the same way.
• {{<stepReference>.response.data.algorithm}} / .encoding}} — the algorithm and encoding used, both needed again for Decrypt.

For example, a step named "Encrypt Card Token" (reference encryptCardToken) — {{encryptCardToken.response.data.encrypted}} and {{encryptCardToken.response.data.iv}}.

Example

Data to Encrypt: {"cardToken": "tok_1234"}
Secret Key: {{variables.tokenEncryptionKey}}
Encryption Algorithm: aes-256-cbc

Decrypt Data

Reverses Encrypt Data, given the same Secret Key, Algorithm, and Encoding, plus the IV that was returned at encryption time.

Configuring it

• Encrypted Data — required. The ciphertext to decrypt.
• Secret Key — required, at least 16 characters. Must be the exact same Secret Key used to encrypt (it's hashed the same way to derive the AES key).
• Initialization Vector (IV) — required. The iv value returned by the original Encrypt Data step.
• Encryption Algorithm — must match what was used to encrypt. Defaults to aes-256-cbc.
• Input Encoding — must match the Output Encoding used to encrypt. Defaults to base64.

A wrong Secret Key, IV, or Algorithm — or ciphertext that's been altered — fails this step with an error rather than returning a structured "invalid" result, so plan for that with Continue On Error or a surrounding error-handling path if decryption failure is an expected case for you.

Reading the response

• {{<stepReference>.response.data.decrypted}} — the decrypted content, always as a string.
• {{<stepReference>.response.data.isJson}} — true if that string parses as JSON.
• {{<stepReference>.response.data.data}} — present only when isJson is true: the parsed object, so you don't have to parse decrypted yourself.

For example, a step named "Decrypt Card Token" (reference decryptCardToken) — {{decryptCardToken.response.data.data.cardToken}} if the original data was JSON, or {{decryptCardToken.response.data.decrypted}} for a plain string.

Example

Encrypted Data: {{encryptCardToken.response.data.encrypted}}
Secret Key: {{variables.tokenEncryptionKey}}
Initialization Vector (IV): {{encryptCardToken.response.data.iv}}
Encryption Algorithm: aes-256-cbc