{"record":{"id":"63f33efc7fc849e4","repo":"n8n-io/n8n","slug":"unauthorized","errorCode":null,"errorMessage":"Unauthorized","messagePattern":"Unauthorized","errorType":"http","errorClass":null,"httpStatus":401,"severity":"warning","filePath":"packages/@n8n/nodes-langchain/nodes/vendors/Microsoft/MicrosoftAgent365Trigger.node.ts","lineNumber":241,"sourceCode":"\n\t\t\tconst activityCapture: ActivityCapture = {\n\t\t\t\tinput: '',\n\t\t\t\toutput: [],\n\t\t\t\tactivity: {},\n\t\t\t};\n\n\t\t\tconst callback = configureAdapterProcessCallback(this, agent, credentials, activityCapture);\n\n\t\t\t// authorizeJWT verifies the Bot Framework token (sets req.user) and 401s on failure\n\t\t\tlet authorized = false;\n\t\t\tawait authorizeJWT(authConfig)(req, res, (err?: unknown) => {\n\t\t\t\tif (!err) authorized = true;\n\t\t\t});\n\n\t\t\tif (!authorized) {\n\t\t\t\t// backstop: ensure a 401 is sent even if the middleware didn't\n\t\t\t\tif (!res.headersSent) {\n\t\t\t\t\tres.status(401).send({ error: 'Unauthorized' });\n\t\t\t\t}\n\t\t\t\treturn { noWebhookResponse: true };\n\t\t\t}\n\n\t\t\tawait agent.adapter.process(req, res, callback);\n\n\t\t\tif (\n\t\t\t\tactivityCapture.activity.type === 'event' ||\n\t\t\t\tactivityCapture.input.trimStart().startsWith('<addmember>')\n\t\t\t) {\n\t\t\t\treturn { noWebhookResponse: true };\n\t\t\t}\n\n\t\t\tlet returnData;\n\n\t\t\tif (node.typeVersion === 1) {\n\t\t\t\treturnData = activityCapture;\n\t\t\t} else {","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/nodes-langchain/nodes/vendors/Microsoft/MicrosoftAgent365Trigger.node.ts#L223-L259","documentation":"Webhook auth backstop in the Microsoft 365 Agent trigger. The Bot Framework authorizeJWT middleware is invoked; if it does not set authorized=true (token missing, expired, wrong audience, or wrong signing key), the node sends HTTP 401 { error: 'Unauthorized' } itself when the middleware didn't already respond, then returns noWebhookResponse. This is not a thrown error — it's an HTTP 401 the trigger emits to the caller.","triggerScenarios":"An incoming Bot Framework request whose JWT fails verification: no Authorization header, expired/revoked token, token signed for a different app id, clock skew, or replay from a non-Microsoft source. Also when the microsoftAgent365Api credential's appId/appPassword (tenant) is misconfigured so the token validation key doesn't match.","commonSituations":"Wrong appId/appTenant in the credential; the Bot Framework endpoint URL changed and the registration wasn't updated; testing the webhook URL directly from a browser (no token) — expect this 401.","solutions":["Verify the microsoftAgent365Api credential: appId, tenant, and secret/password match the Azure app registration used by the Bot Framework channel.","Ensure the Bot Framework channel's messaging endpoint points at the n8n production webhook URL (production/test URL).","Don't hit the webhook URL directly in a browser/curl without a valid Bot Framework token — a 401 here is the correct, expected response to an unauthenticated probe.","Check server clock skew (NTP) — large skew fails JWT exp/nbf validation."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// This is server-side JWT validation; emulate the precondition:\n// the incoming request MUST carry a valid Bot Framework JWT.\nconst authHeader = req.headers['authorization'] as string | undefined;\nif (!authHeader?.toLowerCase().startsWith('bearer ')) {\n  // expect the trigger to respond 401 — do not attempt to process\n  res.status(401).send({ error: 'Unauthorized' });\n  return;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the microsoftAgent365Api credential appId/tenant/secret in sync with the Azure app registration.","Point the Bot Framework messaging endpoint at the correct n8n production/test webhook URL.","Don't probe the webhook URL manually without a Bot Framework token — a 401 is the expected, healthy response.","Keep server time synced via NTP to avoid JWT exp/nbf skew."],"tags":["microsoft","bot-framework","webhook","authentication","jwt","http-401","agent-365"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}