Package installation API now accepts verify flag
Cloud users can now install community packages via the public API by passing a verify flag, fixing a blocker that prevented package installation on restricted n8n instances.
The public API endpoint for installing community packages couldn't complete installation on cloud. The handler hardcoded verify: false, but cloud instances require checksum verification before installing packages — when the environment variable N8N_UNVERIFIED_PACKAGES_ENABLED=false, packages without verified checksums are rejected.
The fix reads verify directly from the incoming request body instead of hardcoding it, and updates the OpenAPI schema to document the new option. Cloud users can now pass "verify": true when installing vetted packages via the public API, matching how the UI controller already worked. Package installation that was silently failing now succeeds when the verify flag is set correctly.
This change lives in the CLI public API handlers, specifically the community packages endpoint. It enables automated deployments on restricted cloud infrastructure where unverified packages are blocked by default.
View Original GitHub Description
Summary
The public API handler for installing community packages hardcoded verify: false, which meant it never fetched a checksum for the package being installed. On cloud, N8N_UNVERIFIED_PACKAGES_ENABLED=false requires a checksum to proceed, that's why installation on cloud failed.
The fix reads verify from the request body instead of hardcoding it, and adds it to the OpenAPI schema — matching how the UI controller already works, so cloud users can now pass "verify": true to install vetted packages via the public API.
Related Linear tickets, Github issues, and Community forum posts
Fixes LIGO-447
Review / Merge checklist
- PR title and summary are descriptive. (conventions) <!-- **Remember, the title automatically goes into the changelog. Use `(no-changelog)` otherwise.** -->
- Docs updated or follow-up ticket created.
- Tests included. <!-- A bug is not considered fixed, unless a test is added to prevent it from happening again. A feature is not complete without tests. -->
- PR Labeled with
Backport to Beta,Backport to Stable, orBackport to v1(if the PR is an urgent fix that needs to be backported)