n8n-io/n8n · warning · UnauthenticatedError

401

401

Error message

Unauthenticated

What it means

Thrown as `UnauthenticatedError` (HTTP 401) by `createScopedMiddleware` when `isAuthenticatedRequest(req)` returns false — i.e. the request lacks a valid auth cookie/API key/JWT. This fires before any scope check, for any route that declares an `@Scope`/accessScope. The error is caught by the global error handler and returned as a 401 response.

Source

Thrown at packages/cli/src/controller.registry.ts:238

			middlewares.push(...route.middlewares);
		}

		return middlewares;
	}

	private createLicenseMiddleware(feature: BooleanLicenseFeature): RequestHandler {
		return (_req, res, next) => {
			if (!this.license.isLicensed(feature)) {
				res.status(403).json({ status: 'error', message: 'Plan lacks license for this feature' });
				return;
			}
			next();
		};
	}

	private createScopedMiddleware(accessScope: AccessScope): RequestHandler {
		return async (req, res, next) => {
			if (!isAuthenticatedRequest(req)) throw new UnauthenticatedError();
			if (!req.user) throw new UnauthenticatedError();

			const { scope, globalOnly } = accessScope;

			try {
				if (!(await userHasScopes(req.user, [scope], globalOnly, req.params))) {
					res.status(403).json({
						status: 'error',
						message: RESPONSE_ERROR_MESSAGES.MISSING_SCOPE,
					});
					return;
				}
			} catch (error) {
				if (error instanceof NotFoundError) {
					res.status(404).json({ status: 'error', message: error.message });
					return;
				}
				throw error;

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Include a valid `Authorization: Bearer <api-key>` header or a valid session cookie.
2. Re-authenticate to obtain a fresh session if the cookie expired.
3. Check that your reverse proxy forwards the `Authorization`/`Cookie` headers.
4. For browser clients, confirm `SameSite`/`Secure` cookie attributes match your deployment.

Example fix

// before
fetch('/rest/v1/users', {})  // 401
// after
fetch('/rest/v1/users', { headers: { Authorization: `Bearer ${apiKey}` } })

function authHeader(cookie?: string, apiKey?: string) {
  if (apiKey) return { Authorization: `Bearer ${apiKey}` };
  if (cookie) return { Cookie: cookie };
  throw new Error('No credentials: provide an API key or session cookie.');
}

function isAuthenticated(res: Response): boolean { return res.status !== 401; }

try { await api.get('/users'); } catch (e) { if (e.response?.status === 401) { await reauthenticate(); await retry(); } else throw e; }

When it happens

Trigger: Calling a scoped REST endpoint with no credentials, an expired session cookie, a revoked API key, or a malformed Authorization header.

Common situations: Session timed out in the browser; API client forgot to send the API key; cookie not sent cross-origin due to SameSite rules; reverse proxy stripping the auth header.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• output.error.errors[0]
• Plan lacks license for this feature
• User is missing a scope required to perform this action
• error.message
• Models couldn't be loaded. Check that the selected credentia

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/193fe834b8420088. Report an issue: GitHub.