Auth0 JWT Token Validation Using JWKS or Public Certificate - n8n Workflow

Developers using Auth0 for identity management who need to secure APIs.
System architects implementing microservices secured by JSON Web Tokens.
Users looking for advanced examples of using the n8n Code node with external npm packages.
Self-hosting n8n users requiring custom security policies before processing requests.

The standard n8n JWT credential setup often falls short when dealing with Auth0 tokens, primarily because Auth0 uses the RS256 algorithm and does not provide access to the private signing key, which is often required by the built-in n8n node. This limitation is solved by this robust n8n workflow template. This automation provides two comprehensive methods—using the dynamic JWKS URI or embedding the public signing certificate—to verify the integrity and authenticity of JWT tokens received via an n8n trigger Webhook. This solution ensures only requests with valid authorization tokens continue through the rest of the n8n workflow, protecting downstream processes and responding with a 401 Unauthorized status if validation fails. Note that this specific n8n workflow requires a self-hosted installation due to external package dependencies for the n8n node functionality.

This n8n template demonstrates two separate yet identical validation paths, both starting with an n8n trigger Webhook node configured to listen for incoming API requests containing a bearer token in the Authorization header.

1. Incoming Request: The process begins when the n8n trigger Webhook node receives an HTTP request, extracting the token from the headers.


2. Token Validation (Code Node): The data passes into a specialized Code n8n node (Using JWK-RSA or Using Public Cert). This n8n node utilizes the required jsonwebtoken library within a NodeJS environment to perform RS256 token verification.


3. JWKS Path: The Using JWK-RSA Code n8n node dynamically fetches the appropriate signing key from the Auth0 JWKS URI using the required jwks-rsa external package before verifying the token signature.


4. Cert Path: The Using Public Cert Code n8n node verifies the token signature against a statically configured public signing certificate.


5. Flow Control: If the token verification succeeds, the decoded payload is attached to the item data, and the execution flows to the success branch (Continue with Request), eventually responding with a 200 OK via a Respond to Webhook n8n node.


6. Error Handling: Both Code nodes are configured with onError: continueErrorOutput. If the n8n node throws an error (indicating an invalid token), the execution automatically flows through the error output path, triggering a Respond to Webhook n8n node to immediately return a 401 Unauthorized HTTP status back to the caller, effectively halting the n8n workflow execution for that specific item.

1. Import the n8n Workflow: Copy the provided JSON data and paste it into your self-hosted n8n instance using the "New" menu -> "Import from JSON".


2. Self-Hosted Requirements: Because this n8n workflow uses advanced Code n8n nodes that require external NPM packages, you must be running a self-hosted instance of n8n.


3. Install Dependencies (JWKS Path): If you use the JWKS approach, you must install the jwks-rsa package globally in your n8n environment (npm i -g jwk-rsa).


4. Enable External Modules: Ensure your n8n environment variable NODEFUNCTIONALLOW_EXTERNAL is set to to allow the Code n8n nodes to import external packages.


5. Configure Code Nodes:

1. Activate: Save and activate the n8n workflow. Use the Webhook URL provided by the n8n trigger nodes to test your secured API endpoint.

Webhook (n8n trigger):
Function: Acts as the API endpoint, initiating the n8n workflow upon receiving an HTTP request.
Key Configuration: Configured with a specific path ID, serving as the entry point for the entire n8n workflow.
Using JWK-RSA (Code n8n node):
Function: Validates the JWT token using keys fetched dynamically from the Auth0 JWKS URI via the jwks-rsa external library. It throws an error if verification fails.
Key Configuration: Uses onError: continueErrorOutput. The JavaScript code includes logic to utilize external libraries and verify against configured audience/issuer fields.
Using Public Cert (Code n8n node):
Function: Validates the JWT token directly against a hardcoded public signing certificate string, offering an alternative verification path within the n8n workflow.
Key Configuration: Uses onError: continueErrorOutput and contains a dedicated variable for the public certificate string.
401 Unauthorized (Respond to Webhook n8n node):
Function: Executes when the token validation fails in the preceding Code n8n node, sending an HTTP 401 Unauthorized status response back to the caller.
Key Configuration: Response Code: 401.
200 OK (Respond to Webhook n8n node):
Function: Executes when token validation succeeds, providing a successful response and allowing the rest of the n8n workflow to run (represented here by the successful response body).
* Key Configuration: Response Code: 200.