Secure API Endpoint with Bearer Token and Payload Validation - n8n Workflow

• Developers needing secure API endpoints without external proxy layers.


• n8n users deploying sensitive webhooks for third-party integrations.


• Anyone looking for reusable n8n templates for robust error handling and API security.


• Automation Specialists prioritizing security in their n8n workflow designs.

This essential n8n workflow template provides a highly secure foundation for any API endpoint you build within n8n. It solves the critical problem of unauthenticated or poorly formed requests hitting your backend logic. By leveraging the initial configuration n8n node, you define your required Bearer token and mandatory payload fields. This structure ensures that only valid, authenticated requests proceed to your main n8n workflow logic. If a request fails the authentication check, the n8n workflow immediately returns a 401 Unauthorized response. If authentication passes but required data fields are missing, it responds with a clear 400 Bad Request. This robust approach significantly improves API reliability and security for your custom n8n installations. This is one of the most vital n8n templates for production environments.

1. The process begins with the Webhook n8n trigger, configured to listen for incoming POST requests at a secure path (e.g., /secure-webhook).


2. The request immediately flows to the Configuration n8n node, which loads the expected bearerToken and a list of requiredFields defined for this specific n8n workflow.


3. The Check Authorization Header n8n node compares the 'Authorization' header from the incoming request against the secret token stored in the configuration.


4. If authentication fails, the n8n workflow branches directly to the 401 Unauthorized n8n node, terminating the process with an error response.


5. If authorized, the flow continues to the Has required fields? Code n8n node, which inspects the request body against the defined required fields list using custom JavaScript.


6. The Check Valid Request If n8n node evaluates the validation result. If fields are missing, the n8n workflow sends a 400 Bad Request response.


7. Only upon successful authentication and validation does the flow reach the Add workflow nodes here placeholder, where the core business logic of the n8n workflow resides.


8. Finally, the Create Response n8n node builds the output JSON, and the 200 OK n8n node delivers the successful webhook response, completing the n8n workflow execution.

1. Import the JSON: Copy the provided n8n workflow JSON and import it into your n8n instance.


2. Set Credentials: This n8n workflow uses the Configuration Set node for security settings instead of n8n credentials.


3. Configure Token: Open the Configuration n8n node and change the value of config.bearerToken from '123' to your strong, unique secret key.


4. Define Required Fields: In the same Configuration n8n node, adjust the config.requiredFields list. For every field you require in the POST body (e.g., userid, data), add a corresponding key (e.g., config.requiredFields.userid). The value does not matter; only the presence of the key is checked by the downstream Code n8n node.


5. Replace Logic: Substitute the placeholder Add workflow nodes here n8n node with your actual n8n workflow logic.


6. Activate: Ensure the n8n workflow is activated to enable the Webhook n8n trigger.

Webhook (n8n trigger): The starting point for this n8n workflow, set to capture POST requests at /secure-webhook. Key Configuration: Response Mode set to 'responseNode'.
Configuration (Set n8n node): Stores global variables used for security checks. Key Configuration: config.bearerToken (set to your secret key) and definition of required request body keys (e.g., config.requiredFields.message).
Check Authorization Header (If n8n node): The primary security gate in this n8n workflow. Function: Compares the incoming 'Authorization' header with the expected Bearer token defined in the configuration.
Has required fields? (Code n8n node): Executes custom JavaScript logic to iterate over the request body and verify the presence of all configured required keys, ensuring data integrity before proceeding with the core n8n workflow.
401 Unauthorized / 400 Bad Request (RespondToWebhook n8n node): Standardized n8n error handling nodes that immediately return a JSON error response with appropriate HTTP codes when triggered by validation failures.
Add workflow nodes here (NoOp n8n node): A clear placeholder where you insert your custom n8n workflow actions (e.g., data processing, storage, or external API calls).

• 200 OK (RespondToWebhook n8n node): Sends the final successful response after all core logic within the n8n workflow has been executed.