I ran into an unusual issue where an API request worked correctly in Postman (200 OK) but the same GET request returned 403 Forbidden from n8n’s HTTP Request node after a version upgrade (from 1.123.9)
The URL, API key and custom headers were the same. I also tried importing the working cURL request from Postman, changing the User-Agent, using JSON headers instead of “Using Fields Below”, and changing redirect settings. None of those fixed it.
The useful clue came from n8n’s raw request output in the browser developer console.
n8n was automatically sending:
Accept: application/json,text/html,application/xhtml+xml,application/xml,text/*;q=0.9,image/*;q=0.8,*/*;q=0.7
Explicitly adding:
Accept: application/json
to the HTTP Request node immediately changed the response from 403 Forbidden to 200 OK.
So if an API works in Postman/cURL but inexplicably returns 403 from n8n, compare the raw request generated by n8n (visible in the browser developer console) and specifically check the automatically generated Accept header.
In my case this was not an authentication, IP allowlist, User-Agent, request-body, or redirect issue. The API apparently rejected n8n’s broad default Accept header.
n8n: 1.123.79
HTTP Request node: 4.2
Axios: 1.18.0
follow-redirects: 1.16.0