Secure API Endpoint with Bearer Token Authentication and Field Validation

This n8n workflow provides a secure API endpoint that enforces Bearer Token authentication and performs essential field validation on incoming requests. It's designed to protect your backend services from unauthorized access and ensure data integrity by rejecting requests that do not meet specified security and data requirements.

What it does

This workflow simplifies the creation of secure API endpoints by:

1. Listening for incoming HTTP requests: It acts as a webhook, ready to receive POST requests.
2. Validating Bearer Token: It checks if the Authorization header contains a valid Bearer Token. If the token is missing or incorrect, it immediately responds with a 401 Unauthorized error.
3. Validating Required Fields: It ensures that the incoming request body contains specific mandatory fields. If any required field is missing, it responds with a 400 Bad Request error, detailing the missing fields.
4. Processing Valid Requests: If both authentication and field validation pass, the workflow proceeds to a placeholder "No Operation" node, indicating where your actual business logic would begin.
5. Responding to the client: It sends appropriate HTTP responses (200 OK, 400 Bad Request, or 401 Unauthorized) back to the client based on the validation results.

Prerequisites/Requirements

• n8n Instance: An active n8n instance to host and run the workflow.
• Bearer Token: A pre-defined secret Bearer Token that clients must include in their Authorization header for successful authentication. This token should be configured within the "Code" node.

Setup/Usage

1. Import the workflow:
   • Copy the provided JSON code.
   • In your n8n instance, click on "Workflows" in the left sidebar.
   • Click "New" and then "Import from JSON".
   • Paste the JSON and click "Import".
2. Configure the Webhook Trigger:
   • The "Webhook" node is already configured to listen for POST requests.
   • Activate the workflow to get its unique URL. This URL will be your secure API endpoint.
3. Configure the Secret Bearer Token:
   • Open the "Code" node named "Validate Bearer Token".
   • Locate the line const expectedToken = 'YOUR_SECRET_BEARER_TOKEN';.
   • Replace 'YOUR_SECRET_BEARER_TOKEN' with your actual secret token.
4. Configure Required Request Body Fields:
   • Open the "Code" node named "Validate Required Fields".
   • Locate the line const requiredFields = ['field1', 'field2', 'field3'];.
   • Modify the array to include the actual field names that are mandatory for your API endpoint.
5. Add your Business Logic:
   • The "No Operation, do nothing" node after successful validation is a placeholder.
   • Replace this node with your actual business logic (e.g., saving data to a database, calling another API, sending notifications, etc.).
6. Activate the Workflow:
   • Ensure the workflow is active by toggling the "Active" switch in the top right corner of the workflow editor.

Example Request

To test the endpoint, send a POST request to the webhook URL with the configured Bearer Token in the Authorization header and the required fields in the JSON body.

Successful Request Example:

curl -X POST "YOUR_WEBHOOK_URL" \
-H "Authorization: Bearer YOUR_SECRET_BEARER_TOKEN" \
-H "Content-Type: application/json" \
-d '{
    "field1": "value1",
    "field2": "value2",
    "field3": "value3"
}'

Response (200 OK):

{
  "status": "success",
  "message": "Request processed successfully."
}

Unauthorized Request Example (Missing/Incorrect Token):

curl -X POST "YOUR_WEBHOOK_URL" \
-H "Content-Type: application/json" \
-d '{
    "field1": "value1",
    "field2": "value2",
    "field3": "value3"
}'

Response (401 Unauthorized):

{
  "status": "error",
  "message": "Unauthorized: Bearer token missing or invalid."
}

Bad Request Example (Missing Fields):

curl -X POST "YOUR_WEBHOOK_URL" \
-H "Authorization: Bearer YOUR_SECRET_BEARER_TOKEN" \
-H "Content-Type: application/json" \
-d '{
    "field1": "value1"
}'

Response (400 Bad Request):

{
  "status": "error",
  "message": "Bad Request: Missing required fields: field2, field3."
}