The HTTP Request node can call any API, but the first wall is authentication. Pasting a key into the URL or into a header field works once and then leaks into every workflow export and execution log. n8n credentials solve this: the secret is stored encrypted and the node sends it for you.
In short. If n8n already has a node for the service, choose Authentication > Predefined Credential Type and reuse that credential: it is the method n8n recommends. Otherwise choose Generic Credential Type: Header Auth for Authorization: Bearer ... or X-API-Key, Query Auth for ?api_key=, Basic Auth for username and password, OAuth2 when the API uses an authorization flow.
Predefined or generic?
| Option | When | Benefit |
|---|---|---|
| Predefined Credential Type | n8n has a node for the service (HubSpot, Google, Slack...) | Reuses the same credential, handles OAuth refresh, lets you call endpoints the node does not offer |
| Generic Credential Type | No native node | You configure the method yourself |
The predefined option is the hidden gem: when the native node lacks an operation, call the API endpoint directly with the HTTP Request node using the native credential, with no extra setup.
Choosing the generic type
The generic types available are Basic auth, Custom auth, Digest auth, Header auth, OAuth1, OAuth2, Query auth and Simplified Custom Auth. Match them to the API documentation:
| The API documentation says | Generic type | Configuration |
|---|---|---|
Authorization: Bearer YOUR_TOKEN | Header Auth | Name Authorization, Value Bearer YOUR_TOKEN |
X-API-Key: YOUR_KEY | Header Auth | Name X-API-Key, Value YOUR_KEY |
?api_key=YOUR_KEY in the URL | Query Auth | Name api_key, Value YOUR_KEY |
| Username and password | Basic Auth | User and password |
| "OAuth 2.0", client ID and secret | OAuth2 API | Auth URL, token URL, scopes, client ID and secret |
| Several headers or a body token | Custom Auth | A JSON definition of headers, query or body values |
The most common mistake with bearer tokens: forgetting the word Bearer and the space before the token in the header value.
Import a cURL command
API documentation usually shows a cURL example. In the HTTP Request node, Import cURL fills the method, URL, headers and body for you. After importing, move any key it placed in a header into a credential and delete the plain-text header. Our cURL to n8n converter shows the result before you paste anything into n8n.
OAuth2 in two minutes
For an OAuth2 API:
- 1 Create the app in the provider's developer console.
- 2 Copy the OAuth Redirect URL shown in the n8n credential into the provider's authorised redirect URIs, character for character.
- 3 Paste the client ID and secret into n8n, set the scopes, and connect.
If the provider answers redirect_uri_mismatch, the two URLs differ, usually by protocol, domain or port. See fix redirect_uri_mismatch in n8n.
Reading 401 and 403 errors
- 401 Unauthorized: the API did not accept the credential at all. Wrong key, missing
Bearer, expired token, or the header name is wrong. - 403 Forbidden: n8n shows "Forbidden - perhaps check your credentials". The API knows who you are, but the key lacks permission or scope for this operation. The documentation suggests updating permissions or scopes, formatting the credential differently, or generating a new key with the right scopes.
Our HTTP Status Explainer lists what each code means for an automation and what to check first.
Dynamic credentials
Need a different account per customer? The documentation suggests routing with a Switch node to HTTP Request nodes that each use their own credential, using an expression in the credential field, or Custom Auth with expressions. Do not fetch secrets in a Code node: Code nodes cannot access credentials by design.
Worked example: calling an endpoint the native node does not offer
You use the native HubSpot node, but you need an endpoint it does not expose. Instead of creating a new key:
- 1 Add an HTTP Request node.
- 2 Authentication: Predefined Credential Type.
- 3 Credential Type: the same service as your native node, then select your existing credential.
- 4 Enter the endpoint URL and method from the API reference.
n8n attaches the same authentication the native node uses, including OAuth2 token refresh. This is the method n8n recommends, and it keeps one credential per service instead of several copies.
Custom Auth for unusual APIs
Some APIs need several values at once, for example a key in a header and an account ID in the query. Custom Auth takes a JSON definition:
Everything in it is stored encrypted with the credential. Use Simplified Custom Auth when you only need a couple of fields.
OAuth2 settings in plain words
| Field | What to put |
|---|---|
| Grant Type | Usually Authorization Code (a user signs in) or Client Credentials (server to server) |
| Authorization URL | The provider's "authorize" endpoint |
| Access Token URL | The provider's "token" endpoint |
| Client ID / Secret | From the app you created in the provider's console |
| Scope | The permissions you need, separated as the provider documents |
| OAuth Redirect URL | Shown by n8n: copy it into the provider's console |
Request the smallest scopes that work. If a call later returns 403, a missing scope is the first suspect.
Security habits that pay off
- One credential per environment. A test key in the test instance, a live key in production.
- Name credentials by purpose. "Stripe live, read only" is clearer than "Stripe 2".
- Rotate on departures. When someone with access leaves, rotate the keys they could see.
- Prefer read-only keys for reporting workflows.
Troubleshooting table
| Symptom | Likely cause | Fix |
|---|---|---|
| 401 Unauthorized | Wrong key, missing "Bearer ", wrong header name | Recheck the credential against the API docs |
| 403 Forbidden | Key valid, permission or scope missing | Add the scope or permission, reconnect |
| Works in Postman, not in n8n | Header or query sent differently | Import the working cURL into n8n and compare |
| OAuth2 stops working after days | Refresh failed or app consent revoked | Reconnect the credential; check the app status |
| redirect_uri_mismatch | Redirect URL not registered exactly | Copy the OAuth Redirect URL from n8n |
Production checklist
- No secret in the URL, a header field or a Code node.
- Predefined credentials wherever a native node exists.
- Minimum scopes on every key.
- One credential per environment (test and production).
- An error branch or error workflow that alerts on 401 and 403, which often signal an expired or revoked key.
Frequently asked questions
How do I add an API key to an n8n HTTP Request?
Set Authentication to Generic Credential Type, then Header Auth (for a header such as X-API-Key or Authorization) or Query Auth (for a key in the URL), and store the key in the credential.
How do I send a bearer token in n8n?
Use Header Auth with Name Authorization and Value Bearer YOUR_TOKEN, including the word Bearer and a space.
Can I use a native node's credential in the HTTP Request node?
Yes. Choose Predefined Credential Type and select the service. This is the method n8n recommends when it is available.
What does "Forbidden - perhaps check your credentials" mean?
The API returned 403: the credential is recognised but lacks permission or scope for the request. Check the key's scopes and permissions.
What is the difference between Header Auth and Custom Auth?
Header Auth sends one header. Custom Auth can send several headers, query parameters and body values defined in JSON.
Can I use one credential in many workflows?
Yes. Credentials are shared across workflows, subject to your instance's sharing settings.
How do I authenticate with an API that needs a token from a login call first?
Some APIs need a first request to get a short-lived token. Use one HTTP Request node to log in, then pass the token to the next request with an expression, or use the OAuth2 Client Credentials flow if the API supports it.
Tags
Steve founded PURIST, a workflow automation studio working with n8n, Make and Claude AI, and is the point of contact on every project. Prices and features in our articles come from vendor documentation and public pricing pages. How we research and score tools.
