Connecting an API mostly means answering one question: how do I prove who I am?
Common types
- API key: a long secret sent in a header or query string.
- Bearer token: a token sent in an Authorization header.
- Basic auth: username and password.
- OAuth2: you sign in and grant permission; n8n stores tokens and refreshes them.
Where to find it
The service’s developer documentation explains which type it uses and where to place the secret.
Store it in credentials
Create a credential in n8n and select it in the HTTP Request node, instead of typing keys into fields or the Code node. That keeps secrets out of your workflow export.
Limit permissions
Create keys with the smallest access that works, and rotate them if shared or leaked.
Test
Make one simple read request first. If it fails with 401 or 403, recheck the key, scope and header name.
Related
Full request setup: HTTP Request node. Safety: security checklist.
Quick answers
What is the difference between API key and OAuth?
An API key is a fixed secret; OAuth uses sign-in and tokens that can be refreshed.
Where do I put the key?
In n8n credentials, selected in the node.
Why 403 after adding the key?
The key may lack permission or be sent in the wrong place.
Related reading
- How to Connect Google Sheets to n8n: Read, Add and Update Rows
- How to Send Emails with n8n: Gmail, SMTP and Good Practice
- How to Connect the WhatsApp Business Cloud API to n8n
Ready to turn n8n into a real skill?
Join a practical, trainer-led n8n course with projects like lead capture, notification flows, an AI step and a tool-using agent. Ask for a free counselling call to see if it fits your goal.
See the 15-day n8n training | Find your city | Book free counselling