Introduction

Most real-world APIs refuse unauthenticated requests. Before you can pull data from Stripe, post to Slack, or query a CRM, you need to prove who you are. n8n handles this through its Credentials system — a secure, encrypted store that keeps secrets out of your workflow JSON and lets you reuse the same auth config across multiple nodes.

This lesson covers the three patterns you will encounter in at least 80% of integrations: API keys passed as a header, Bearer tokens, and the OAuth2 authorization code flow. By the end you will know how to configure each one in n8n and how to wire them into an HTTP Request node when a built-in node does not exist for your target service.

API Keys and Custom Headers

The simplest auth pattern: the service issues you a static key, and you send it on every request, usually as a custom header like X-API-Key or as a query parameter.

In n8n, go to Credentials > Add Credential > Header Auth. You supply the header name and value once, and n8n injects it automatically on every request that uses that credential.

Example: Connecting to a weather API that requires a key in the header.

In the HTTP Request node, set Authentication to Header Auth, select your saved credential, then configure the request:

{
  "method": "GET",
  "url": "https://api.weatherapi.com/v1/current.json",
  "qs": {
    "q": "Hanoi"
  }
}

n8n will attach the header automatically — you never hard-code the key in the node itself. If the API expects the key as a query parameter instead (e.g. ?apikey=...), use the Query Auth credential type instead of Header Auth. Same idea, different placement.

A common mistake is pasting the key directly into a Set node or URL field. That embeds the secret in the workflow JSON, which gets exported, version-controlled, and shared. Always use Credentials.

Bearer Tokens

Many APIs — especially those following OAuth2 client credentials or issuing short-lived JWTs — expect an Authorization header in this exact shape:

Authorization: Bearer <token>

In n8n, this is still a Header Auth credential. Set the Name field to Authorization and the Value field to Bearer followed by a space and your token:

Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

If your token expires and needs to be refreshed programmatically, add a preceding HTTP Request node that calls the token endpoint, extract the access_token from the response with an expression like {{ $json.access_token }}, and pass it into the Authorization header of the next node. This creates a simple two-node token refresh pattern without any custom code.

OAuth2 Authorization Code Flow

OAuth2 with the authorization code flow is more involved because it requires a browser redirect — the user must visit the provider, log in, and grant permission before n8n receives an access token. n8n automates most of this.

Step 1: Create an OAuth2 API credential. Go to Credentials > Add Credential > OAuth2 API. Fill in the fields from your app registration on the provider side:

{
  "Grant Type": "Authorization Code",
  "Authorization URL": "https://accounts.google.com/o/oauth2/auth",
  "Access Token URL": "https://oauth2.googleapis.com/token",
  "Client ID": "your-client-id",
  "Client Secret": "your-client-secret",
  "Scope": "https://www.googleapis.com/auth/spreadsheets"
}

Step 2: Set the redirect URI. n8n shows you its callback URL (something like https://your-n8n-instance.com/rest/oauth2-credential/callback). Copy this into the Authorized Redirect URIs field of your OAuth app on the provider dashboard.

Step 3: Click Connect my account in n8n. A browser popup opens, you log in and approve, and n8n stores the resulting access and refresh tokens automatically. From this point forward, n8n also handles token refresh silently — when the access token expires, it uses the refresh token to get a new one without any action from you.

For built-in nodes like Google Sheets, Slack, or HubSpot, n8n pre-fills the Authorization URL and Access Token URL — you only need the Client ID, Client Secret, and the scope list from the provider docs.

Common Errors and How to Fix Them

401 Unauthorized almost always means the credential is misconfigured or the token has expired. Check that the header name matches exactly what the API docs specify — some APIs use X-Auth-Token, others use api-key (lowercase), and the mismatch is invisible until runtime.

403 Forbidden means the token is valid but lacks the required scope. Go back to your OAuth app, add the missing scope, and re-authorize. n8n does not automatically re-request new scopes.

If OAuth2 Connect fails with a redirect_uri_mismatch error, the callback URL in n8n and the one registered on the provider do not match exactly — check for trailing slashes or http vs https differences.

Never store secrets in workflow expressions or node parameters. n8n encrypts everything in the Credentials store using your instance encryption key. If you need to rotate a key, update it once in the Credential, and every workflow using it picks up the change immediately.

Summary

Use Header Auth for static API keys, use Bearer token headers for short-lived tokens with a refresh step if needed, and use the OAuth2 Authorization Code credential type for delegated user authorization. In all cases, store secrets in n8n Credentials — never inline in workflows. The HTTP Request node works with all three patterns through its Authentication dropdown, making it your fallback for any service that does not have a dedicated n8n node.