Hi, i have an issue with connecting an API

Questions
1

I’m trying to connect a service with an API and HTTP node and i can’t point the API key to the credential i’m creating in my account.

In their API docs they say that i need to pass the credentials in this way:

curl -X ‘POST’ \ ‘https://api.sumit.co.il/accounting/customers/create/’ \ -H ‘accept: text/plain’ \ -H ‘Content-Type: application/json-patch+json’ \ -d ‘{ “Details”: { “ExternalIdentifier”: null, “NoVAT”: null, “SearchMode”: null, “Name”: “Danny Dean”, “Phone”: “050-1234567”, “EmailAddress”: “[email protected]”, “City”: null, “Address”: null, “ZipCode”: null, “CompanyNumber”: “514000123”, “ID”: null, “Folder”: null, “Properties”: null }, “Credentials”: { “CompanyID”: 12345678, “APIKey”: “R576Z62qzuans7dXGOkks8jEalaTisyFrUhraKth9Eksz1GBYQ” }, “ResponseLanguage”: null }’

Please share your workflow

When i try to run the HTTP node with the api key in the body it works, but i prefer not to have the key exposed in the body, so i tried adding it in the credential section in my account, but i cant point to it in the body using {{$credential[‘SUMIT TEST’].value}} .. it simply doesnt work..

image
image1903×1216 183 KB

image
image1664×1034 122 KB

image
image1728×971 42.9 KB

This is their API docs: תיעוד REST API מלא של מערכת SUMIT לניהול העסק

What am i doing wrong here?

Because i think its not secured to pass the key like that in the body of the http request no?

Will really appreciate some help here :folded_hands:

Information on your n8n setup

  • n8n version: 1.112.5
  • Database (default: SQLite): SQLite
  • n8n EXECUTIONS_PROCESS setting (default: own, main): own
  • Running n8n via (Docker, npm, n8n cloud, desktop app): xCloud (Docker managed)
  • Operating system: xCloud managed environment
2

Great question. Does api allow having credentials specified anywhere else except the http request’s body?

3

Anybody?! :folded_hands:

4

@Adeative_Media this is the problem with API design, it treats credentials as part of the request body (which against security best practices), you’re design this API then you need to make change follow some recommendations out there ( Best practices for REST API security: Authentication and authorization - Stack Overflow )

This is problem with the API provider, not n8n!

5

Yes defiantly! i didn’t think its an n8n issue.. so if i do want to use it as they provide.. what can i do to make sure its fully secured? any idea? @trungtlt

6

@Adeative_Media , an additional proxy layer should help, but tradeoff is latency & cost.

You can try Cloudflare Worker or something similar.

7

I think i got it!
I’ve added the details as variables in the environment of n8n

image
image1272×789 59.6 KB

Now i send the request in the body like this:

{
“Details”: {
“ExternalIdentifier”: null,
“NoVAT”: null,
“SearchMode”: null,
“Name”: “רזי בדיקה”,
“Phone”: “050-1234567”,
“EmailAddress”: “[email protected]”,
“City”: null,
“Address”: null,
“ZipCode”: null,
“CompanyNumber”: “514000123”,
“ID”: null,
“Folder”: null,
“Properties”: null
},
“Credentials”: {
“CompanyID”: {{ $env.SUMIT_COMPANY_ID }},
“APIKey”: “{{ $env.SUMIT_API_KEY }}”
},
“ResponseLanguage”: null
}

Works great.. the question is now.. if this is secured. because the only place to see these details are in the server.

I’ve asked chatGpt and he recommended to add N8N_ENCRYPTION_KEY to the environment, but when do that the site is going down and i get bad gateway.. i think something related to the encryption..

Do you think its good enough? @trungtlt

8

@Adeative_Media depend on your expected level of security, but at least above option allow you to not hard-coding company ID & API key in the n8n workflow JSON!
Space for improvement still there (with trade-off too), keep reviewing your system/need and improve it!

9

You’re right that keeping the API key in the body isn’t ideal. In n8n, credentials don’t automatically inject into the body — they work for headers, auth, etc. If the API requires it inside the body, the usual approach is:

  • Store your API key in a credential (or environment variable).

  • Then in the HTTP node body, reference it using expression mode like:

"APIKey": {{$credentials.SUMIT_TEST.APIKey}}

(make sure the name matches your credential property).

If the built-in credentials system doesn’t map directly, another safe option is to use environment variables and reference them in the body.

10

Hi, yeah so i was able to reference it as a variable, but not as a credential..

Didn’t find any other option..

11

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.