Automating SFTP and FTP transfers with n8n: no more manual file drops

Its death has been announced for twenty years, and yet: the file dropped on an SFTP server remains the lingua franca of B2B exchanges — supplier catalogs, accounting exports, bank feeds, interfaces with line-of-business software that will never have an API. As long as those transfers are manual ("every Monday, Karen fetches the file and imports it"), they concentrate a well-documented risk: a study by Liginlal, Sim and Khansa published in 2009 in Computers & Security ("How significant is human error as a cause of privacy breaches?", see on Google Scholar) found human error to be the leading cause of the data-leak incidents analyzed — file sent to the wrong recipient, wrong version imported, plain omission. Automating these flows with n8n eliminates precisely that class of error. Here's how to do it properly.

n8n's FTP node: one node, two protocols

n8n's FTP node speaks both FTP and SFTP — the choice lives in the credential. In practice, insist on SFTP whenever possible (end-to-end encryption), and prefer SSH key authentication: n8n's SFTP credential accepts a private key with a passphrase, safer and more revocable than a password. Like any secret, the key lives exclusively in the credential manager — the reflexes from our guide to securing credentials apply in full.

Five operations cover every case: List (list a remote folder), Download (fetch as binary), Upload (drop), Rename (rename or move) and Delete. Files travel as binary data between nodes — for large volumes, our guide to binary data and large files explains how to avoid exhausting memory.

Pattern 1: picking up a partner's drops

SFTP doesn't notify: you poll. The typical workflow:

1. Schedule Trigger at the interval the flow requires (5 minutes for orders, nightly for accounting).
2. FTP – List on the agreed drop folder.
3. New-file filtering: comparison against the list of already-processed files, kept in a Data Table (name + size + date). It's the file-world equivalent of webhook idempotency: without this guardrail, a file processed twice doubles the downstream writes.
4. FTP – Download then processing: CSV or Excel extraction, validation of expected columns, load into the database or target application.
5. Archiving: Rename to archive/YYYY-MM/, or to errors/ if processing failed.

The polling-specific trap: catching a file mid-upload. Agree with the sender on a final rename (upload as .tmp, rename to .csv when complete) or check that the size is stable across two listings before downloading.

Pattern 2: dropping your exports at a partner's

In the other direction — sending a ledger to the accountant, a catalog to a marketplace, a payment file to the bank — the workflow flips: generate the file (an Excel or CSV export, an invoice PDF), then FTP – Upload to the agreed folder, under a temporary name renamed at the end if the partner polls on their side.

Always add a proof of deposit: after the upload, a verification List checks the file's presence and size, and the result is logged (Data Table, or a message in an ops Slack channel). The day the partner claims nothing arrived, that trail is worth gold.

The concrete case: the supplier stock file

The canonical example combines both patterns: every night, the supplier drops its stock file; n8n fetches it, validates the format, updates the levels — the flow detailed in our guide to Shopify inventory sync — then archives the file and logs the outcome. Twenty minutes of weekly clicking becomes a workflow that runs at 3 a.m. and alerts when something's off.

Reliability: what separates production from duct tape

• Retries and timeouts: partners' SFTP servers go down, restart, saturate. Enable the node's retries with a delay between attempts, as for any fragile HTTP request.
• Error Workflow: a transfer failing at 3 a.m. should produce an alert at 3:01 a.m., not a discovery at 9:30.
• Validate before loading: a present file isn't a correct file. Check columns, encoding and plausible volume before writing anything; when in doubt, error folder and alert.
• Environments: hosts, paths and folder names belong in environment variables, not in the workflow — essential for dev/prod separation.

An SFTP flow automated with these guardrails is boring in the noble sense: it runs for months without anyone thinking about it — which is exactly what you want from a file exchange.