API Bearer Token Validation and Access Control using Airtable - n8n Workflow

• Backend developers requiring robust API authentication.


• Technical teams seeking to deploy secure microservices using n8n.


• Users looking for detailed n8n templates focusing on security and complex conditional routing.


• Organizations using Airtable as a lightweight data store for user or token management.

This comprehensive n8n workflow template provides a powerful, low-code solution for implementing secure API authentication and authorization. It addresses the common need to restrict access to specific resources based on a user's token validity and ownership rights. By leveraging the n8n platform, this automation acts as a lightweight API gateway. The n8n workflow handles essential security checks: validating the request format, looking up the Bearer token in Airtable, checking the token's active status (simulating expiry), finding the requested job, and finally, verifying that the user associated with the token is authorized to view that specific job ID. If any check fails, the relevant error status (400, 401, or 404) is immediately returned, securing your backend data access. This makes for highly efficient and secure operation within the n8n environment.

The process is initiated by an n8n trigger, specifically the Webhook node, configured to listen for GET requests.

1. Request Reception and Method Handling: The GET jobs n8n trigger receives the request. A separate Webhook n8n node handles all other HTTP methods (POST, PUT, etc.) and immediately returns a 405 error.


2. Initial Validation: The Validator Code n8n node inspects the incoming request headers and query parameters, ensuring the Authorization header is present and correctly formatted (Bearer ) and that only the jobid parameter is included. Failure results in an immediate 401 Unauthorized response.


3. Token Lookup in Airtable: If validation passes, the Get token Airtable n8n node extracts the Bearer token ID and searches the 'Tokens' base in Airtable.


4. Token Existence and Status Check: The Token Exists If n8n node verifies the lookup success. If the token is missing, the n8n workflow returns a 400 'invalid token' error. If found, the Active If n8n node checks the 'Is Active' field; if false, a 401 'Token is expired' error is returned.


5. Resource Retrieval: If the token is valid and active, the Find job Airtable n8n node retrieves the resource data (the 'Job') based on the incoming jobid. If the resource is not found (Job found? fails), a 404 'Job not found' error is returned.


6. Authorization Verification: The Owner? If n8n node performs the final check, comparing the Issued To field from the token record against the Users field of the job record. If they don't match, the request is blocked with a 401 'unauthorized' response.


7. Successful Response: Only upon passing all security and authorization checks, the format job Code n8n node restructures the output data, and the Return data Respond to Webhook n8n node sends the final 200 OK response with the requested job details.

1. Import the n8n workflow: Copy the provided JSON data and paste it directly into your n8n instance using the Import Workflow feature.


2. Airtable Setup: You must clone the example Airtable Base linked in the workflow's sticky note (or create your own structure) containing 'Tokens' and 'Jobs' tables, ensuring they store the necessary fields like token id, Is Active, and resource ownership details.


3. Credentials: Update the credentials for both Airtable n8n node instances (Get token and Find job) to use your own Airtable API Key and link them to your cloned base.


4. Webhook Configuration: Activate the workflow. The GET jobs n8n trigger will provide you with the live URL endpoint needed for testing.


5. Testing: Use the embedded 'Test the request' section (Manual Trigger and HTTP Request n8n node) to simulate an API call with valid and invalid Bearer tokens and job_id parameters to verify the logic.

• GET jobs (Webhook n8n trigger): The primary entry point, listening for GET requests on the specified path (test-jobs). It captures the Authorization header and query parameters.


• Validator (Code n8n node): Essential for security, this custom n8n node script enforces strict validation rules on headers (must be Bearer) and query parameters (must only contain jobid).


• Get token (Airtable n8n node): Searches the 'Tokens' table using the extracted Bearer token ID via a formula filter to retrieve token metadata.


• Token Exists & Active (If n8n node): Key control flow elements. The first checks for a record existence; the second checks if the Is Active field is true, ensuring expired tokens are rejected early in the n8n workflow.


• Find job (Airtable n8n node): Searches the 'Jobs' table using the jobid provided in the query.


• Owner? (If n8n node): Performs the final authorization check by comparing linked user IDs across the token and job records. This is critical application logic in this n8n workflow.


• Respond to Webhook n8n node (Multiple instances): Used throughout the n8n workflow to return specific HTTP error codes (400, 401, 404) or the final 200 OK response, ensuring proper API behavior.