n8n · Authentication Profile

N8N Authentication

Authentication

n8n secures its APIs with apiKey and http across 3 declared security schemes, as derived from its OpenAPI definitions.

AgentsArtificial IntelligenceIntegrationWorkflowsAutomationLow Code

Methods: apiKey, http Schemes: 3 OAuth flows: API key in: header, cookie

Security Schemes

ApiKeyAuth apiKey

· in: header (X-N8N-API-KEY)

BearerAuth http

scheme: bearer

CookieAuth apiKey

· in: cookie (n8n-auth)

Source

Authentication Profile

generated: '2026-09-03'
method: searched
docs: https://docs.n8n.io/connect/n8n-api/authentication
source: >-
  https://docs.n8n.io/connect/n8n-api/authentication.md +
  openapi/n8n-public-api-openapi.yml (provider-published contract)
summary:
  types:
    - apiKey
    - http
  api_key_in:
    - header
    - cookie
notes: >-
  API keys are created in Settings > n8n API with a label and expiration; on
  Enterprise plans keys can be restricted to scopes (see scopes/n8n-scopes.yml).
  The API is not available during the free Cloud trial. The instance-level MCP
  server authenticates separately via OAuth (recommended) or a bearer personal
  access token.
schemes:
  - name: ApiKeyAuth
    type: apiKey
    in: header
    parameter: X-N8N-API-KEY
    description: Primary public-API authentication; key created under Settings > n8n API.
    sources:
      - openapi/n8n-public-api-openapi.yml
      - https://docs.n8n.io/connect/n8n-api/authentication
  - name: BearerAuth
    type: http
    scheme: bearer
    bearerFormat: JWT
    sources:
      - openapi/n8n-public-api-openapi.yml
  - name: CookieAuth
    type: apiKey
    in: cookie
    parameter: n8n-auth
    description: Browser-session cookie auth (used by the instance UI).
    sources:
      - openapi/n8n-public-api-openapi.yml
mcp_auth:
  methods: [oauth, bearer-token]
  docs: https://docs.n8n.io/connect/connect-to-n8n-mcp-server/
  note: OAuth with per-client permissions and scope selection at consent (n8n 2.32+); tokens rotatable, revocation per client.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/n8n-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.