n8n-nodes-zalo

Readable n8n community package for Zalo personal-account automation through zca-js.

Disclaimer: this package drives the unofficial Zalo Web API via zca-js. It can violate Zalo's Terms of Service and may get accounts flagged, rate-limited, or banned. Use at your own risk on accounts you control.

Features

• Login with Zalo cookie.
• Experimental login with Zalo QR.
• Save login result as an n8n zaloUserApi credential by calling the n8n Public API.
• Validate session and fetch account/user information.
• List groups, get group metadata, and get group members.
• Fetch group chat history.
• Trigger workflows on new Zalo messages.

Security Defaults

The package intentionally does not include license checks, premium gates, telemetry, obfuscation, custom servers, or workflow mutation.

Defaults:

• checkUpdate=false
• logging=false
• includeRaw=false
• includeSensitiveData=false

Sensitive values are redacted from normal outputs and errors:

• cookies
• IMEI
• full user agent
• phone numbers
• n8n API keys
• Zalo secrets

Credentials

Zalo User API

Internal name: zaloUserApi

Fields:

• cookie
• imei
• userAgent
• language
• checkUpdate
• logging

n8n Public API

Internal name: n8nApi

Used only by Zalo Auth when Save as Credential is enabled.

Fields:

• baseUrl
• apiKey

Nodes

Zalo Auth

Operations:

• Login With Cookie
• Login With QR
• Validate Credential

QR login emits the generated QR image to the n8n UI while the node is running. After the phone confirms login, the node saves the returned cookie and IMEI as a zaloUserApi credential when Save as Credential is enabled.

When saving credentials, the node creates one standalone zaloUserApi credential through POST /api/v1/credentials. It does not modify existing workflows or auto-attach credentials to nodes.

Zalo Account

Operations:

• Validate Session
• Get Me
• Get User Info
• Get Context

Zalo Group

Operations:

• Get All Groups
• Get Group Info
• Get Group Members

Zalo Message

Operations:

• Get Group Chat History

Zalo Trigger

Events:

• New Message

Filters:

• Thread type: all, direct, group
• Include self messages
• Include raw payload

Only one Zalo Web listener can run per account. Opening Zalo Web elsewhere can disconnect the listener. The trigger does not auto-reconnect; fix the session and reactivate the workflow.

Development

npm install
npm run build
npm test
npm pack --dry-run

Manual Test Checklist

• Valid cookie creates a zaloUserApi credential.
• Invalid cookie returns a login error without logging cookie data.
• Missing IMEI returns ZALO_MISSING_CREDENTIAL_FIELD.
• Created credential can be selected manually in Account/Group/Message/Trigger nodes.
• Group history normalizes text and attachment messages without crashing.
• Trigger emits direct and group messages and stops on workflow deactivation.

Notes

This package depends on [email protected] and Node.js 18+. n8n Public API credential creation can vary by n8n version and deployment plan.