Skip to content
Hermes AI Agent + n8n AI Agents Browse on AWS

The n8n dashboard

You open n8n in your browser at your instance's address, https://<public-ip>/. This page covers how that works, and the settings behind it. For the first visit, see the Quick start.

How you sign in

  1. The first visit asks for your instance's ID, the i- ID shown on the instance's page in the EC2 console. Until n8n's owner account exists, nobody gets to n8n without it.
  2. n8n's owner setup comes next: you create the account you sign in with.
  3. From then on, the address opens n8n's own sign-in page. The instance ID page does not appear again.

A wrong instance ID is refused, and after ten wrong tries from one address, that address waits 15 minutes.

Turn on two-factor sign-in

In n8n, open Settings, then Personal, and turn on two-factor authentication. Optional, but highly recommended for a dashboard on the internet.

The certificate

The dashboard uses HTTPS with a certificate from Let's Encrypt, issued for your instance's own IP address. You do not need a domain, and there is nothing to set up:

  • The instance gets its certificate a few seconds after it starts.
  • Certificates last about six days and renew themselves automatically.
  • Ports 80 and 443 must stay open to every address in the security group: Let's Encrypt checks the instance from the internet to issue and renew the certificate. If you narrow them, HTTPS stops working within days, and comes back within minutes of reopening them.
  • Visiting http://<public-ip>/ sends you on to https://.

Use the IP address, not the long ec2-...amazonaws.com name, which has no certificate.

When the address changes

Stopping and starting the instance gives it a new public IP address. The dashboard follows it by itself: the new address gets its own certificate within seconds of the instance starting, and n8n's links and webhook addresses move to it. Find the new address in the EC2 console.

The old address stops working, so update any bookmark, and any outside service that calls one of your webhooks.

Keep the same address

An Elastic IP stays with your instance through stops and starts. In the EC2 console, choose Elastic IPs, Allocate Elastic IP address, then Actions, Associate Elastic IP address, and pick your instance. The dashboard moves to it within five minutes, restarting n8n once.

An Elastic IP costs the same as the instance's own public address while it is attached. Release it when you terminate the instance, or AWS keeps charging for it.

Webhooks and forms

Because n8n has a public HTTPS address, outside services can reach it:

  • Webhook triggers called by other services, such as Stripe or GitHub, at https://<public-ip>/webhook/...
  • App triggers that register a webhook, including n8n's Telegram trigger
  • Public n8n forms and chat pages

They work once n8n's owner account exists, and only for workflows you publish. Each one is as open as you build it: use the authentication options on n8n's Webhook node for anything that should not be public.

What is never served

Some addresses on the instance are not reachable through the dashboard, whatever you choose:

  • Hermes's own connections to n8n (its tools and the workflow builder). Hermes reaches n8n inside the instance, so the dashboard does not affect it.
  • The Hermes API, which n8n uses to ask Hermes.

n8n's public API

n8n has a REST API for other programs, under /api/v1. The dashboard blocks it by default. To use it from another machine, for example a deployment script, open it, then create an API key in n8n under Settings, n8n API:

sudo hermes-n8n public-api on    # and back with: sudo hermes-n8n public-api off

Each request still needs an n8n API key. The API keeps working on the instance itself and through an SSH tunnel either way.

Check the dashboard

sudo hermes-n8n web status

It shows the address, the certificate and when it expires, whether the first sign-in has happened, whether the public API is open, and the firewall.

Keep n8n off the internet

To close the dashboard and reach n8n only through an encrypted tunnel from your own computer:

sudo hermes-n8n web off    # and back with: sudo hermes-n8n web on

This stops serving n8n at the instance's address and closes ports 80 and 443 in the instance's firewall. You can then remove the HTTPS and HTTP rules from the security group. Hermes keeps working either way. Webhooks from outside services stop working while the dashboard is off.

With the dashboard off, open n8n through a tunnel:

In a terminal on your computer:

ssh -i <key>.pem -L 5678:127.0.0.1:5678 ubuntu@<public-ip>

Then open http://localhost:5678. Keep that terminal open while you use n8n.

If port 5678 is already in use on your computer, pick another local port, for example -L 8678:127.0.0.1:5678, and open http://localhost:8678.

With the Session Manager plugin installed and the instance set up for Session Manager:

aws ssm start-session --target <instance-id> \
  --document-name AWS-StartPortForwardingSession \
  --parameters '{"portNumber":["5678"],"localPortNumber":["5678"]}'

Then open http://localhost:5678. No inbound port is needed at all.

The tunnel also works while the dashboard is on. The address is http://: the tunnel itself is encrypted. Closing the tunnel closes the editor, not n8n, and scheduled workflows keep running.

Last updated October 26, 2026 · Suggest an improvement