Tinylytics + n8n

n8n talks to Tinylytics through the same two building blocks every other client uses: outbound webhooks for things that happen to you, and the API for things you go and ask for. There is no official Tinylytics community node yet, so you assemble the built-in Webhook, HTTP Request, and Code nodes yourself — which sounds like more work than it is, and we have sample workflows below to save you the first hour.

What works today

Webhooks require an active paid subscription. API keys are available from Account Settings → API Access. Prefer webhooks over tight polling when you can — API requests are rate limited.

Sample workflows

Import these into n8n (⋯ menu → Import from File), then follow the sticky notes in each workflow.

The sample workflows stop at a formatted message (or equivalent). Connect Slack, email, Discord, Linear, or any other n8n node yourself — Tinylytics does not ship those credentials.

1. Receive Tinylytics webhooks in n8n

Requirements

• Paid Tinylytics plan
• An n8n instance with a public HTTPS URL (Tinylytics blocks localhost and private network URLs)
• Webhook platform set to Generic (not Discord)
• Wrap content left off for the sample expressions

If you only need Discord downtime embeds, Tinylytics already has a native Discord webhook platform — you do not need n8n for that path.

Steps

1. Import receive-webhooks.json (or recreate the flow below).
2. Open the Tinylytics Webhook node, activate the workflow, and copy the Production URL.
3. In Tinylytics go to Account Settings → Webhooks, create a webhook with that URL, select the event types you want, and save.
4. Copy the signing secret into the Verify Signature Code node (SIGNING_SECRET).
5. Use Send Test on the webhook edit screen. You should see a successful delivery and a workflow execution in n8n.

Signature verification

Tinylytics signs the exact JSON body with your webhook signing secret and sends:

X-Signature: sha256=<hex HMAC SHA-256 digest>

Also sent: X-Tinylytics-Event, X-Tinylytics-Delivery, X-Tinylytics-Timestamp.

In n8n:

1. Enable Raw Body on the Webhook node (required — the signature is over the raw bytes, not re-serialized JSON).
2. Verify with a Code node using the binary raw body, for example:

const crypto = require('crypto');

const SIGNING_SECRET = 'your-signing-secret';
const headers = $input.item.json.headers || {};
const signature = String(headers['x-signature'] || '');
const rawBody = await this.helpers.getBinaryDataBuffer(0, 'data');
const expected = 'sha256=' + crypto.createHmac('sha256', SIGNING_SECRET).update(rawBody).digest('hex');

const sigBuf = Buffer.from(signature);
const expBuf = Buffer.from(expected);
if (sigBuf.length !== expBuf.length || !crypto.timingSafeEqual(sigBuf, expBuf)) {
  throw new Error('Invalid Tinylytics webhook signature');
}

return { json: $input.item.json.body };

Treat deliveries as at-least-once. Store X-Tinylytics-Delivery, or hit.id / kudo.uid / analytics_event.id / insight.id / check.id, if duplicate handling matters.

Full payload shapes are documented in Webhooks.

Event types (core)

Ignored paths, ignored visitors, spam-suppressed writes, imports, seeds, and similar non-live writes do not emit hit/kudo/custom-event webhooks. See Webhooks.

2. Call the Tinylytics API from n8n

Auth

Authorization: Bearer tly-ro-your-api-key
Accept: application/json

Use a read-only key (tly-ro-...) for GET workflows. Use a full-access key (tly-fa-...) only when you intentionally write hits, events, kudos, signals, sites, or groups.

Create keys under Account Settings → API Access. Base URL: https://tinylytics.app/api/v1.

Smoke test

HTTP Request node:

• Method: GET
• URL: https://tinylytics.app/api/v1/me
• Header: Authorization: Bearer tly-ro-...

A valid key returns HTTP 200 with your account payload.

Useful read endpoints for automation

Date query params use YYYY-MM-DD. Analytics ranges default to UTC day boundaries; pass time_zone=user to use your account timezone. Details: API docs.

Example: yesterday’s top paths

GET https://tinylytics.app/api/v1/sites/SITE_ID/hits
  ?grouped=true
  &group_by=path
  &start_date=YYYY-MM-DD
  &end_date=YYYY-MM-DD
  &time_zone=user
  &per_page=10

That is what daily-top-paths.json calls. Grouped-by-path rows include views (and unique_views when unique hits are enabled).

What is not available

These gaps are listed plainly so you do not spend an evening building a workflow that can never fire:

Troubleshooting

Related docs

• Webhooks
• API Reference
• Uptime Monitoring
• Integrations & Plugins