SFTP integration with encrypted secrets

SFTP integration with encrypted secrets

SFTP integration pushes LandedFees exports (finding batches, audited-entry CSVs, calculation CostLayer exports) to your SFTP server. Common for importers whose data platforms are inside a VPN and cannot receive webhooks over the public internet. Password auth or private-key auth are both supported.

Every credential is encrypted at rest using the shared secret from lib/integrations/crypto.ts. Nothing is stored in plaintext in the database or logged.

How to set up an SFTP push

1. In LandedFees, open /integrations.
2. Click New integration and choose SFTP.
3. Enter the host, port (defaults to 22), and username.
4. Choose auth type: Password or Key.
5. For password auth, paste the password. For key auth, paste the private key (RSA or Ed25519). Both are encrypted immediately and never displayed again in plaintext.
6. Enter the target directory. Relative paths are relative to the SSH user's home; use absolute paths if you need to write outside home.
7. Optional: pin the host key (SHA-256 fingerprint) so a MITM host cannot silently intercept.
8. Save. Use Test push to send a small hello-world file and confirm end-to-end.

Once configured, LandedFees writes exports to the target directory as new events occur.

File naming

Filenames follow landedfees_{event}_{yyyy-mm-dd}_{delivery_id}.csv. Predictable enough for a downstream cron to pick up, unique enough not to overwrite.

Secret storage

Passwords and private keys are encrypted with an authenticated symmetric cipher on write. The key is held in a KMS the operator controls; the cipher and the wrapping are documented in lib/integrations/crypto.ts. Rotation happens on-demand from the integration page (this rotates the wrapping only, not the underlying SSH credential).

Frequently asked questions

Can I push to my S3 bucket instead

Not through this integration. Use the generic outbound webhook to a Lambda that writes to S3, or ask about the roadmap for a native S3 integration.

What SSH ciphers are supported

Modern ones. AES-CTR, ChaCha20-Poly1305, and the standard Ed25519 and RSA host key algorithms. Legacy DSA and SSH-1 are not supported.

Can I use key auth with a passphrase-protected private key

Yes. Enter the passphrase alongside the private key. Both are encrypted the same way.

How do I revoke access

Delete the integration from /integrations. Delete also erases the encrypted credential from the database. Rotating your SSH credential on the server side is a good second step.