Expense Reimbursement Approvals with Duo Security in n8n

Route expense reimbursements through Duo Security approvals in n8n

This Duo Security example workflow collects an expense reimbursement request in an n8n form and uses Duo Security Push to get a manager’s explicit approval or denial—then automatically sends the request down the approved or rejected path.

What this workflow does

• Collects request details: The form gathers employee, expense description, amount, currency, date, and reference. Each visible label becomes an n8n output key.
• Preserves context for review: A “Set Approval Context” step keeps the submitted fields and adds the trusted manager username.
• Checks manager access: “Check Manager Access” calls Duo PREAUTH to verify the manager account and determine available factors.
• Requests approval securely: “Request Manager Approval” sends a synchronous Duo Push using safe expense context (reference, employee, amount, currency, and description).
• Branches on explicit outcome: “Manager Approved?” evaluates whether Duo returned an explicit allow result and routes to the approved or rejected branch.
• Integrates with your back-office: Replace the outcome sections with your finance, payroll, notification, or audit actions.

Use cases

• Employees submit reimbursement requests via an n8n form; managers approve in Duo Mobile.
• Ensure only explicitly approved expense requests proceed to payroll processing.
• Capture a clear audit trail by routing approved vs. rejected cases to your internal records.
• Control access to approvals by mapping trusted employees to trusted Duo manager usernames.

Technical details

• Workflow type: n8n automation workflow using form trigger and decision logic.
• Nodes used: form trigger, set, if, sticky note, and n8n-nodes-duoduo security.
• Duo integration: Duo PREAUTH for factor/account checks and synchronous Duo Push for approval/denial.
• Setup: Import the workflow, create a Duo Security credential (Auth API integration key, secret key, hostname), configure the manager username in “Set Approval Context,” then test with a non-production request to trigger the Duo Push.