n8n-io/n8n · error · ForbiddenError

403

403

Error message

You do not have permission to update provider connections

What it means

Thrown by CredentialsService.updateInstanceCredential when hasGlobalScope(user, 'credential:manageInstance') is false. Instance (provider) credentials are written through a dedicated path that requires the global instance-management scope; ordinary project-level credential:update is insufficient.

Source

Thrown at packages/cli/src/credentials/credentials.service.ts:1038

			name: string;
			type: string;
			data: ICredentialDataDecryptedObject;
		},
	): Promise<ICredentialsDb> {
		const encrypted = await this.createEncryptedData(credential);
		await this.externalHooks.run(`credentials.${event}`, [encrypted]);
		return encrypted;
	}

	async updateInstanceCredential(
		user: User,
		credentialId: string,
		data: CredentialRequest.CredentialProperties,
		ctx: OperationContext,
		options: InstanceCredentialWriteOptions = {},
	): Promise<CredentialsEntity> {
		if (!hasGlobalScope(user, 'credential:manageInstance')) {
			throw new ForbiddenError('You do not have permission to update provider connections');
		}

		const credential = await this.credentialsRepository.findInstanceCredentialById(
			credentialId,
			ctx,
		);
		if (!credential) {
			throw new NotFoundError(`Credential with ID "${credentialId}" could not be found.`);
		}

		const prepared = await this.prepareUpdateData(user, data, credential, {
			operationContext: ctx,
		});
		if (prepared.type !== credential.type) {
			throw new BadRequestError(
				'Provider connection type cannot be changed. Create a new connection instead.',
			);
		}

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Grant the user/role the global 'credential:manageInstance' scope (admin/owner action).
2. Perform the update as an admin user with instance-management rights.
3. Route the change through project credentials if instance-level management is not intended for this user.

if (!user.globalScopes?.includes('credential:manageInstance')) {
  throw new Error('User cannot manage instance credentials — requires admin.');
}
await updateInstanceCredential(user, id, data, ctx);

function canManageInstance(user: { globalScopes?: string[] }): boolean {
  return !!user?.globalScopes?.includes('credential:manageInstance');
}

When it happens

Trigger: Calling the instance-credential update path (e.g. provider connections management) as a non-admin user without the global 'credential:manageInstance' scope.

Common situations: A project member or custom role attempts to edit an instance/provider connection. Admin-only endpoint called from a low-privilege session token.

Related errors

• 404
• 404
• 400
• 0
• LangSmithTelemetry creates its own tracer — do not use .otlp

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/cdc8f85b61a82c85. Report an issue: GitHub.