API Authentication Methods

Hello! Welcome back to our course on mastering n8n.

In the last lesson, you learned how to use the powerful HTTP Request node to make custom API calls. We successfully retrieved and created data using a public API, but we deliberately set aside the crucial topic of authentication. Today, we fill that gap.

This lesson is all about securely connecting to APIs. As a developer, you know that hard-coding API keys, tokens, or other secrets directly into your code (or in this case, your workflow) is a major security risk. This lesson will teach you how to authenticate with APIs using API keys, Bearer tokens, and OAuth2, leveraging n8n's robust and secure credential management system. This is the professional way to handle API integrations.

1. The n8n Credential Store: Your Digital Vault

Before diving into specific methods, it's essential to understand n8n's philosophy on credentials. n8n treats credentials as a separate, reusable, and secure entity, much like you would use environment variables or a dedicated secrets manager (like HashiCorp Vault or AWS Secrets Manager) to keep sensitive data out of your application's source code.

When you configure authentication in an HTTP Request node, you have two primary choices:

• Predefined Credential Type: A simplified, guided setup for services that have a dedicated n8n integration node (e.g., Google, HubSpot, Airtable). n8n has already figured out the authentication details for you.
• Generic Credential Type: A flexible, manual setup for any other API. This gives you direct control over the authentication mechanism.

We will explore both in this lesson.

2. Method 1: API Keys (via Header or Query Auth)

An API key is the simplest form of authentication. It's a unique string that you send with your request to identify your application. API documentation will specify how to send it, but it's usually in one of two ways:

• As a request header: e.g., X-Api-Key: YOUR_SECRET_KEY
• As a query parameter: e.g., https://api.example.com/data?api_key=YOUR_SECRET_KEY

In n8n, you handle these using the Header Auth and Query Auth generic credential types, respectively.

In the previous lesson's video, "n8n HTTP Request Node & Tool", you saw a practical example of setting up a generic credential for Appify using Query Auth (timestamp 42:46 - 44:33). The API required the token in the URL (?token=...), making Query Auth the correct choice.

3. Method 2: Bearer Tokens

Bearer Token authentication is a specific standard for sending tokens. It's extremely common in modern REST APIs. The token is sent in the Authorization header, prefixed with the word "Bearer" and a space.

Format: Authorization: Bearer <your_token>

The term "bearer" implies that whoever possesses (or "bears") the token is authorized to access the resources.

n8n has a dedicated Bearer Auth generic credential type that simplifies this. You only need to provide the token, and n8n handles formatting the header correctly.

Real-World Example: Airtable Personal Access Tokens

Let's look at a practical, developer-focused example. Airtable recently deprecated its old API keys in favor of "Personal Access Tokens." These new tokens are functionally Bearer tokens. The video we used in the last lesson contains an excellent walkthrough of this exact scenario.

This example shows that while the UI might say "API Key" or "Personal Access Token," if the documentation tells you to put it in an Authorization: Bearer ... header, you're dealing with a Bearer Token.

curl -X GET 'https://api.anyservice.com/v1/items' \
-H 'accept: application/json' \
-H 'x-api-token: sk_123abc456def'

4. Method 3: OAuth2

OAuth2 is not just an authentication method; it's a protocol for delegated authorization. It allows a user to grant a third-party application (like your n8n workflow) limited access to their data on another service (like Google Calendar or Slack) without sharing their password.

The process is more complex and involves several steps, including a user-interactive consent screen.

The Main Actors in OAuth2:

• Resource Owner: The user who owns the data.
• Client: Your n8n application that wants to access the data.
• Authorization Server: The service that prompts the user for consent and issues access tokens (e.g., accounts.google.com).
• Resource Server: The API that stores the user's data (e.g., gmail.googleapis.com).

Setting up OAuth2 in n8n involves a one-time configuration where you exchange information between the service provider and your n8n credential settings.

While OAuth2 is the most complex to set up initially, n8n handles the most difficult part for you: token refreshing. Access tokens are typically short-lived. Once configured, n8n will automatically use the refresh token to get a new access token in the background, ensuring your workflows continue to run without interruption.

5. Predefined vs. Generic: A Final Look

Now that you understand the underlying mechanisms, the benefit of Predefined Credentials becomes clear. When you use a predefined credential for "Google Sheets," for example, n8n presents you with a simple "Connect my account" button. Behind the scenes, it's performing the entire OAuth2 dance you just learned about.

This is why the recommended practice is:

1. Always check for a Predefined Credential Type first.
2. If one doesn't exist, use the appropriate Generic Credential Type based on the API's documentation.

The FuturMinds video provides a great summary of this decision-making process.

Conclusion

You have now added the most critical component for building professional-grade API integrations to your n8n skillset: secure authentication. You've moved beyond public APIs and are now equipped to connect to virtually any service on the web.

Key Takeaways:

• Never hard-code secrets: Always use the n8n credential store to keep your workflows secure and portable.
• Read the documentation: The API provider's documentation is the ultimate source of truth for which authentication method to use.
• You learned to configure the three most common authentication patterns:
  • API Keys using Header Auth or Query Auth.
  • Bearer Tokens using the dedicated Bearer Auth type.
  • OAuth2 for delegated user permissions, handling the multi-step setup process.
• Prefer Predefined Credentials for simplicity when available, but master Generic Credentials for universal connectivity.

In this lesson, you successfully authenticated and received data. In our next lesson, "Extract and map data from JSON API responses using expressions," we will focus on what to do with that data. You'll learn how to navigate the JSON output from your API calls and use n8n's powerful expression editor to pick out, transform, and use the exact pieces of information you need.