n8n Webhook Authentication: Header, Basic or JWT

By Roman Rodomansky·Published 13 Oct 2026

n8n webhook authentication step by step: add Header, Basic or JWT auth to a Webhook node, try rejected and accepted calls with curl, and pick a method.

• Webhooks
• n8n
• API integration
• Tutorial

Checked against the cited sources on 13 Oct 2026.

Goal and prerequisites

This tutorial shows n8n webhook authentication on a practice workflow. The goal is a Webhook node that rejects calls without valid credentials and accepts calls that have them. According to the n8n docs, the Webhook node can require callers to authenticate with Basic auth, Header auth or JWT auth, or with no authentication at all.

You need an n8n workspace, a workflow with a Webhook trigger, and curl or Postman to send requests. This guide comes from the supplied documentation and community sources. We did not test it ourselves, so confirm each result on your own n8n version.

Sources: Webhook | Nodes | n8n Docs

Steps to add n8n webhook auth with a Header auth credential

We use Header auth for the practice build because it needs the least setup. The steps below are ordered; follow them in sequence. The test sequence and the long random value are our suggested practice, not a documented n8n procedure.

1. Add a Webhook node and note both the test URL and the production URL.
2. Create a Header auth credential: enter a header Name and a Value. Use a long random value.
3. In the Webhook node, set Authentication to Header auth and select that credential.
4. Call the test URL with curl: once with no header, once with a wrong value and once with the right value.
5. Publish the workflow, then repeat the three calls against the production URL and check the Executions tab.

The Webhook node has separate test and production URLs. The test URL registers when you use Listen for Test Event, or run the workflow while it is not active, and the editor then shows the incoming data. The production URL registers when you publish the workflow, and its calls appear in the Executions tab rather than in the editor. Older n8n versions may say activate instead of publish.

In our view, a long random header value is the right choice for a first build. It is simple to create, simple to send from curl, and simple to rotate later. As an editorial expectation, not documented behavior: a call with no header or a wrong value should be rejected and should not start the workflow. The right value should start it, shown in the editor for the test URL or under Executions for the production URL.

Sources: Webhook | Nodes | n8n Docs, Webhook credentials | Nodes | n8n Docs

Using Basic auth or n8n webhook authentication with JWT

Basic auth uses a credential with a Username and Password. The n8n docs say JWT auth uses the JWT credential, whose key type is either a Passphrase or a PEM key. The credential docs list passphrase (HMAC secret) or PEM key pair options, and algorithms from the HS, RS, ES and PS families plus none. The docs give no security advice on the none option, so look into it before choosing it.

1. Create the credential: Username and Password for Basic auth, or a JWT credential with a Passphrase or PEM key and an algorithm.
2. In the Webhook node, set Authentication to Basic auth or JWT auth.
3. Select the credential you created in the node's credential field.
4. For JWT, send the token in an Authorization header with the Bearer prefix, as community members describe.
5. Run the same test calls as in the Header auth steps.

A community member wrote in April 2025 that a JWT is sent as an Authorization header with the Bearer prefix, and that the Webhook trigger then exposes the token content in a jwtPayload property. That is a community account, not documented behavior. A Medium tutorial from September 2025 covers an Auth0 token: a PEM key credential holding the public key and an algorithm such as RS256.

Be careful with claims. A consultancy founder, writing on a vendor blog in September 2025, makes the point below. The docs we have do not say which claims the built-in check covers, so test with an expired token.

Basic auth has its own version caveat. A GitHub issue against n8n 2.9.0 reported a 403 instead of a 401 for wrong Basic auth credentials, and a maintainer later said it was fixed in n8n 2.30.0. Rejected-call status codes may differ by version.

Sources: Webhook credentials | Nodes | n8n Docs, JWT credentials | Nodes | n8n Docs, Using JWTs (JSON Web Tokens) for Authenticated Webhooks - Tips & Tricks - n8n Community, Authentication with n8n is Easier Than You Think | by Sean Spaniel | Medium, n8n Webhooks: A Beginner’s Guide (with Security Built-In), Webhook Basic Auth Returns 403 Instead of 401 for Invalid Credentials · Issue #26365 · n8n-io/n8n · GitHub

Choosing a method for production callers

The supplied docs give no security ranking of the three n8n webhook authentication methods. The comparison below is editorial advice, partly echoing a 2026 vendor blog from n8nlogic, which favors Header auth for machine-to-machine calls and JWT when the caller already issues tokens, and rates Basic auth weakest. That blog promotes its own services, so treat it as opinion.

We'd skip Basic auth unless the caller supports nothing else.

Sources: Webhook credentials | Nodes | n8n Docs, n8n Webhook Node: Triggers, Auth & Responding (2026) | n8nlogic

Hardening, rotating secrets and troubleshooting

Alongside n8n webhook authentication, the Webhook node's IP(s) Allowlist option returns a 403 for callers outside the list, and an empty list allows every address. It limits who can try, so use it in addition to authentication, not instead.

One vendor agency advises a separate credential per calling system, so rotating one secret does not break the other callers. It also warns that leaving authentication on none lets anyone with the URL start the workflow. A community author adds that very long token expiries make a leaked token hard to invalidate. For storage, n8n documents external secret stores on n8n Cloud Enterprise and self-hosted Enterprise, with providers such as HashiCorp Vault and AWS Secrets Manager; the page does not say whether webhook credentials can use them.

If a call is not rejected, check that the node's Authentication is not still none and that you called the right URL mode. If every call fails, compare the header Name and Value exactly. Do not share the URL until the rejected calls fail as expected.

Sources: Webhook | Nodes | n8n Docs, Using JWTs (JSON Web Tokens) for Authenticated Webhooks - Tips & Tricks - n8n Community, Configure the n8n Webhook Node: 15 Parameters Explained | Hack'celeration, Use external secret stores | Administer | n8n Docs