Signing in to APIs
🎯You'll be able to
Sign in with API keys, bearer tokens, basic auth and OAuth, using the least access needed.
🏠The everyday picture
Some buildings let you in with a staff card. Some give a visitor pass that expires at 6 pm. Some ask the person you're visiting to come down and vouch for you. APIs use similar methods.
📘What it really is
- API key: a long secret string sent in a header or query. Simple; treat it like a password.
- Bearer token: a token sent as
Authorization: Bearer .... Often it expires and must be renewed. -
Basic auth: a username and password (or key ID and secret) combined in a header. Razorpay's API, for example, uses a key ID and key secret this way.
-
OAuth 2.0: the user signs in on the provider's own page and approves access, and your workflow receives tokens. A refresh token lets the platform renew access without the user signing in again. Google, Microsoft and many CRMs use it.
-
Scopes limit what a token can do, such as "read contacts" but not "delete contacts". Ask for the smallest set you need (DA6 least access).
-
In n8n, set these up as credentials: either a credential type for that app, or a generic one (header auth, basic auth, OAuth2) attached to the HTTP Request node. Keys stay out of the workflow itself.
📝A worked example
Sharma Textiles' integrations by sign-in method:
| System | Method | Notes |
|---|---|---|
| ShipFast courier | API key in header | Separate test and live keys |
| Payment gateway | Key ID and secret (basic auth) | Test mode keys for building |
| Google Sheets | OAuth 2.0 or service account | Access to two named sheets |
| CRM | OAuth 2.0 with scopes | contacts.read, contacts.write, deals.write |
When setting up the CRM, the consent screen asked for "full account access" by default. You changed the requested scopes to the three the workflows use.
🌍Where it's used
- Every integration needs one of these.
- Security reviews: clients ask what access each connection has.
- Troubleshooting: many "it stopped working" calls come from expired or revoked tokens.
📝Case scenario
A workflow worked for weeks, then every call to a marketing tool returns 401. The person who connected it changed their password,
which revoked the app's OAuth tokens. You reconnect it using a shared business account, note the dependency in the credentials list
from DA6, and add the 401 to the alert rules so it reaches the credential's owner.
🖱️Try it
For each system your workflows connect to, write its sign-in method, where the secret is stored, which scopes or permissions it has, and whether it expires.
⚠️Common mistakes
- Using a personal login for a business workflow. Sign: it breaks when the person leaves. Fix: use a business-owned account or app.
- Ignoring token expiry. Sign: everything fails one morning with 401. Fix: note expiry dates and alert before they run out.
🛠️For your project
The simulator uses basic auth for the gateway and bearer tokens for accounts and CRM. Project 1 test 8 simulates an expired token.
✅Quick check
What does a refresh token do in OAuth 2.0?
Show the answer
It lets the platform get new access tokens without the user signing in again.
Why request the smallest set of scopes?
Show the answer
So a leaked or misused token can do as little harm as possible.