Flow, accounts, and hosting
Connect a secrets vault to Duaer
Duaer reads secrets from an external vault and places them only in credential fields. Values are not shown on screen. Expressions use $secrets. From v3, project editors and admins have this access by default.
Connect the vault
Open External Secrets in Duaer Settings and fill in the connection the vault asks for. The help link on that screen points at this section. The connection is the vault’s access method. It is not a paste of every secret into Duaer.
Until it is connected, credential fields cannot pick an external secret, and $secrets in an expression is not available.
Use a secret in a credential
A secret only appears in the picker on a credential field. After you pick it, Duaer fetches it at runtime. The screen does not show the value, and the execution record should not contain the plaintext either. The $secrets completion hint also hides the value, and it is only available in credential fields.
Do not write a secret into a node parameter or a variable. Anyone who can open Variables can read a variable.
Access for project roles
On an instance licensed for external secrets, Duaer v3 gives project editors and admins the external-secrets scopes by default and removes the old Settings toggle. If that toggle was off before the update, those roles become wider. The breaking-change check on the instance links to this section.
On an instance that is not licensed for external secrets, that check does not apply. A finer split still goes through custom roles.
Questions
Does Duaer show an external secret on the credential screen?
No. Duaer reads the secret from a connected vault and places it in a credential field. The screen never shows the secret value. Expressions can use $secrets, and that still does not display the plaintext. Without a connected vault, $secrets is not available.
Who can use external secrets on project roles after Duaer v3?
On a Duaer instance licensed for external secrets, v3 gives project editors and admins external-secrets scopes by default, and removes the Settings toggle for External Secrets. If that toggle was off before the update, those role permissions become wider after it.
In this section
Where a failed node goes in Duaer
Duaer uses On Error on the node to stop, continue, or take the error output. After a production run fails, a separate digital organization that starts with Error Trigger is what receives it.
FlowWhen a Duaer run runs out of memory
A Duaer JavaScript heap out of memory error means the run filled the Node.js heap. Carry fewer items and less binary data before you raise the heap or split work onto workers.
FlowRun per item or once in Duaer
Duaer runs a node once per incoming item by default. Execute Once makes it a single run. Loop Over Items splits items into batches so they are not all in memory at once.
FlowCall another digital organization in Duaer
Duaer calls another digital organization with Execute Sub-workflow. The called one starts with Execute Sub-workflow Trigger, and the caller policy decides who may call it.
AccountsAdd people and roles in Duaer
Duaer uses the owner and roles to decide who can see projects, digital organizations, and credentials. Invites need SMTP. Without the matching plan, an invited person does not see other people’s digital organizations and credentials.
AccountsSign in to Duaer with LDAP
Duaer can connect to an LDAP directory so those users sign in with their directory password. Mapping roles to groups is on the LDAP setup page, not on the sign-in form.
AccountsMap LDAP groups to Duaer roles
Duaer LDAP role provisioning maps a directory group to an instance role or a project role. The provisioning note in Settings opens this page, not the directory connection itself.
AccountsProvision roles for Duaer OIDC
Duaer OIDC finishes the identity provider’s client and redirect first, then maps the provider’s groups to Duaer roles. Sign-in alone does not make roles follow groups.
AccountsProvision roles for Duaer SAML
Duaer SAML sign-in needs metadata, the ACS URL, and a certificate first. Role provisioning then maps groups in the assertion to Duaer roles. The note in Settings opens this page.
AccountsAdd two-factor authentication to a Duaer account
In Duaer, each person can protect their own account with an authenticator app. The instance can also require two-factor authentication for every member. Anyone who has not paired a device does that at the next sign-in.
AccountsUse custom roles in a Duaer project
A custom role in Duaer is an extra permission set inside a project, so not everyone has to be the same kind of member. Without the matching plan, the screen does not offer it.
HostingManage Duaer environments with Git
Duaer source control pushes digital organizations and credential metadata to a Git remote so environments can match. Instance enforcement does not travel with the repository.
HostingConnect Duaer to a Git remote
Duaer source control needs a remote URL and a deploy public key. After you add that key on the Git host, pull and push are not rejected.
HostingEnvironments and projects in Duaer
A Duaer environment is an instance in source control. A project is a permission boundary on one instance. Who is in a project does not appear on another instance just because Git moved the content.
HostingCommit and sync in Duaer
After Duaer source control is connected, changes are committed and pushed, then pulled on the other side. Saving on the canvas does not show up in another environment.
HostingPush and pull in Duaer
A Duaer push sends committed changes to the Git remote. A pull brings remote commits back. Resolve conflicts first. Duaer does not quietly merge two environments into one copy.
HostingSend Duaer logs somewhere else
Duaer can send logs to an external destination you choose, or write them to a file or the console with environment variables. Log streaming is not the execution record. Turning it off does not delete runs you already have.
HostingSee how Duaer ran over a period
Duaer Insights summarizes failures and time over a period. It is not the input and output of one execution. When there is no data yet, the banner opens this page.
APIOperate Duaer through the API
The Duaer public API uses a key created in Settings. The key has scopes. Those scopes, plus the role of the person who created the key, decide which digital organizations it can change.
APIHow the Duaer public API takes a key
When you call the Duaer public API, put the key in the X-N8N-API-KEY header. Do not put it in the URL. The full key is shown once, when you create it.
APIRead the API on your Duaer instance
The Duaer public API is at /api/v1 on the instance. Which routes answer depends on the version and the key’s scopes. This page does not copy a route list that would go stale.
ReleasesWhere Duaer version notes live
Updates and release notes in the Duaer product open the version pages on doc.duaer.com. Version numbers follow this product line. Upgrades that change behavior have their own breaking-change pages.
ReleasesHow to read Duaer release notes
Duaer release notes say what that version adds. A breaking-change page keeps only behavior that changes on upgrade and that you need to check. A picker bug fix is usually not a breaking change.
ReleasesBehavior that changes in Duaer v3
Duaer v3 turns Chat hub off by default and removes it in v4. Project roles get external-secrets access by default. A further set of nodes, caller policy, and deployment changes should be read before you upgrade.
ReleasesMove up from before Duaer 1.0
This page is for a Duaer instance still on pre-1.0 habits. Confirm which major version you are crossing, then open that version’s breaking changes. The instance check names the rules that match.
ReleasesBehavior that changes in Duaer 2.0
Duaer 2.0 ignores --tunnel, upgrades dotenv, and tightens environment access, files, binary storage, plus a set of commands and nodes. The instance check links each rule to its section.
HostingRun Duaer in queue mode
Duaer queue mode hands executions to workers. The main process accepts work and queues it, with Redis in between. Regular mode runs in the same process.
HostingLimit how many Duaer executions run at once
Duaer concurrency control caps how many executions run at the same time. Past the cap, new executions wait. It does not cap how many nodes are on the canvas.
HostingWhen self-hosted Duaer fills the heap
When self-hosted Duaer reports a full heap, look at how much data one run carries, then at the process heap and the workers. Raising memory without carrying less data fills it again.
HostingWhere Duaer stores binary data
Duaer writes binary data to the filesystem or the database and keeps a reference on the execution. In-memory mode is gone. An instance still on memory mode is told to change it by the upgrade check.
HostingWhat community registration means in Duaer
After a Duaer community instance is registered, a badge appears beside headings such as Usage and Plan. Registration is not an enterprise license, and it does not turn on every paid feature.
HostingUsers and mail on self-hosted Duaer
Self-hosted Duaer needs SMTP before invite mail can go out. Users and roles stay in Settings. Without the plan, an invited person does not see other people’s digital organizations and credentials.
HostingWhich key Duaer uses to encrypt credentials
Duaer encrypts credentials with the environment variable N8N_ENCRYPTION_KEY. If the key is lost or changed, saved credentials cannot be decrypted. Digital organizations remain. Accounts have to be saved again.
HostingHow to set the Duaer encryption key
Set N8N_ENCRYPTION_KEY to a long random string that belongs to that instance. The example does not publish a fixed key to reuse. Do not share one between production and development.
HostingEnvironment variables on the Duaer process
Duaer environment variables belong to the host process: the encryption key, execution mode, and logging. They are not $vars on the canvas. A change to .env takes effect after a restart.
HostingWhere to put environment variables for Duaer
Duaer reads configuration from the process environment, a .env file, or variables injected by the container. Restart after a change. After the dotenv upgrade in 2.0, check quotes and comments again.
HostingSQLite or Postgres for Duaer
Duaer supports SQLite and Postgres. A single process can use SQLite. Use Postgres when queue mode or several processes share the data. Do not let several processes write one SQLite file.
HostingConfigure task runners for Duaer
A Duaer task runner executes work such as the Code node in a separate process. Newer main images do not include the runner. v3 shortens the default timeout to one minute.
HostingSend Duaer traces to OpenTelemetry
Duaer can send a run’s traces to an OpenTelemetry collector. With no collector configured, the switch still delivers traces to nobody. This is not the same data as log streaming or the execution record.
HostingWhich Duaer command-line commands remain
Duaer 2.0 replaces update:workflow and ignores --tunnel. Take subcommands from this version’s --help. The docs do not keep a second list of commands that were removed.
HostingUpdate a Duaer instance
Before you update Duaer, keep the encryption key and the database, and read the breaking changes you are crossing. In queue mode, workers and the main process need the same version.
HostingRun a Duaer security audit
A Duaer security audit is a read-only list of credentials, nodes, and instance settings worth checking. It does not change digital organizations, and it does not reveal secret values.