Azure OpenAI behind APIM (AI Gateway) – How to authenticate from n8n Agent?

Describe the problem/error/question

Hi everyone,
I’m running into an integration challenge with Azure OpenAI behind an Azure API Management (APIM) AI Gateway, and I’m not finding a clear way to configure this in n8n.

The problem

In n8n:

  • The Azure OpenAI / OpenAI credentials only allow an API key field
  • The key is sent as a standard OpenAI-style authorization
  • There is no option to define custom headers required by APIM

My setup

  • Azure OpenAI resource

  • Exposed through Azure APIM (AI Gateway)

  • APIM requires a custom HTTP header (Ocp-Apim-Subscription-Key)

  • Direct calls to the APIM endpoint work fine using tools like Postman or curl

  1. Is there a way to configure custom headers for Azure OpenAI credentials in n8n?
  2. Can a custom LLM or Agent-compatible node be used with APIM?
  3. Is using the HTTP Request node the only workaround—and if so, how can it be integrated with the new Agent framework?

Information on your n8n setup

  • n8n version: 1.107.4
  • Database (default: SQLite): postgres
  • n8n EXECUTIONS_PROCESS setting (default: own, main):
  • Running n8n via (Docker, npm, n8n cloud, desktop app): Openshift

Hi @Bel_Sh Welcome!
Currently there is no option to add a custom header like Ocp-Apim-Subscription-Key to the credential or node itself, as it only supports either an API key or azure entra id, although you can try something like first create OpenAI credentials , and there set your API key to 1. Ocp-Apim-Subscription-Key value and then set your BASE URL to your APIM endpoint, and THEN use the openAI chat model node to try and see if that works for your azure based AI gateway.

hi @Bel_Sh
if APIM requires a custom header like Ocp-Apim-Subscription-Key, I would use an HTTP Request node (or a custom tool wrapper) to call the APIM endpoint and then connect that into the Agent flow, because the standard OpenAI/Azure OpenAI credentials are optimized for native auth patterns and don’t expose arbitrary custom-header configuration for every gateway scenario.

Azure APIM auth is tricky with standard credentials. The API key field workaround might work (set subscription key as API key + change base URL), but that’s a hack. For production reliability I’d go with HTTP Request node + manual APIM endpoint handling, or submit a feature request for custom-header support in Azure OpenAI credentials. What’s your use case—are you testing or already in production?

Thank you for your warning

It seems useful to advise people to be gentle with AI responses.

I actually use AI daily because I recognize that I don’t know everything, so I use it primarily to learn and to teach.

To give you an idea of ​​my situation, I don’t speak English, so when I see a question, I translate it into Portuguese, then check if I can help immediately. If I can’t, I research the error, check if it makes sense within my knowledge, then translate it into English, and then post it in the community.

I could easily configure a program to make the response more humanized (or appear more human-like), and that would be really useful. If you observe, there are responses that are well-aligned with human formatting, well-punctuated, with impeccable organization in their line of reasoning. Could it be that an AI wrote it? It might be, or it might be that the person really knows how to write excellently.

I can configure the AI ​​to make grammatical errors or misspell words. I can make various configurations to pass through human eyes and even bypass AI-detection algorithms.

I won’t do any of that, because when someone uses AI in their answer, I admire the way they used it. I see that they researched the question that was posted, formatted the answer in a way that the other person understands, and then posted it.

Don’t be bothered if I use AI or how much I use it.

I recommend you be bothered if you notice that someone simply copied the question, pasted it into ChatGPT, took the answer, and pasted it into the community.

I read the community rules. I imagine you read them too.

I copied and pasted the rules below:

Rules
Do not use AI to generate or format your answers (we cannot distinguish the difference, therefore both practices are prohibited).

Participate in a conversation only if you have something substantial to contribute, such as a genuine attempt to solve the problem or a request for clarification when essential information is missing.

Don’t engage in “misappropriation of solutions” - related to the previous point, don’t repeat solutions or add minimal information to try to attribute the solution to yourself.

Play fair. This is subjective, but you know when you’re not playing fair. :wink:

Note that the first point PROHIBITS the use of AI to generate or format answers.

So you see that I haven’t broken any rules, because I don’t use AI simply to generate answers. I’ve been working on it and I use AI to enrich my studies, enrich the possibilities of solving doubts, verify points of conflict, align thoughts, so that I can then have something that I understand to be useful for the community and post it in the community.

I don’t use it to format questions, that is, to take something from a website, ask the AI ​​to make it look nice, and then post it.

And I respect all the other rules, I simply respect all the rules, exactly as the rules ask.

I hope I have clarified your doubts, or those of anyone else who reads and has questions about my posts, to make it clear how I answer questions and the care I take in doing so.

I want to make it clear that I set aside time each day, just as others do, to access the community, see the questions, study, answer them, and be helpful in some way.

Thank you for your time.

Congratulations

In APIM, you can change the header name under API Settings, not necessarily the ‘Ocp-Apim-Subscription-Key.’.

In case you don’t want to handle the subscription.
I created a community node that enables using APIM with an OAuth2 token.

https://www.npmjs.com/package/n8n-nodes-azure-openai-ms-oauth2

You have to validate the token in the API policy.

In APIM, you can change the header name under API Settings, not necessarily using ‘Ocp-Apim-Subscription-Key.’.

In case you don’t want to handle the subscription.
I have created a community node that enables using APIM with an OAuth2 token.

https://www.npmjs.com/package/n8n-nodes-azure-openai-ms-oauth2

You have to validate the token in the API policy.