n8n-io/n8n · error · NodeOperationError

Authentication failed - invalid API key or endpoint.

Error message

Authentication failed - invalid API key or endpoint.

What it means

In the connection/initialization catch block of getAzureAISearchClient, an error whose message contains '401', 'Unauthorized', or 'authentication failed' is reclassified as an authentication NodeOperationError. It means Azure AI Search rejected the API key or endpoint during client setup/index access.

Source

Thrown at packages/@n8n/nodes-langchain/nodes/vector_store/VectorStoreAzureAISearch/VectorStoreAzureAISearch.node.ts:299

		if (error instanceof NodeOperationError) {
			throw error;
		}

		// Log the full error for debugging
		context.logger.debug('Azure AI Search connection error:', {
			message: error instanceof Error ? error.message : String(error),
			code: (error as any).code,
			statusCode: (error as any).statusCode,
			details: (error as any).details,
		});

		// Check for authentication errors
		if (
			error.message?.includes('401') ||
			error.message?.includes('Unauthorized') ||
			error.message?.includes('authentication failed')
		) {
			throw new NodeOperationError(
				context.getNode(),
				'Authentication failed - invalid API key or endpoint.',
				{
					itemIndex,
					description:
						'Please verify your API Key and Search Endpoint are correct in the credentials configuration.',
				},
			);
		}

		// Check for authorization errors (403)
		if (error.message?.includes('403') || error.message?.includes('Forbidden')) {
			throw new NodeOperationError(
				context.getNode(),
				'Authorization failed - insufficient permissions.',
				{
					itemIndex,
					description:

View on GitHub (pinned to 5ac6606e81)

Solutions

Verify the API key and Search Endpoint in the credential match the Azure search service.
Regenerate/confirm the key in the Azure portal and update the credential.
Ensure the endpoint URL exactly matches your Azure AI Search service name.
Run a manual REST call to the endpoint with the key to isolate n8n vs Azure.

Defensive patterns

Strategy: validation

Validate before calling

// Smoke-test the credential with a lightweight call before the workflow runs.
const res = await fetch(`${endpoint}/indexes?api-version=2023-11-01`, {
  headers: { 'api-key': apiKey },
});
if (res.status === 401) throw new Error('Azure AI Search key/endpoint rejected (401).');

Try / catch

try {
  client = await getAzureAISearchClient(context, embeddings, itemIndex);
} catch (e) {
  if (/401|Unauthorized|authentication failed/i.test(e.message ?? '')) {
    // prompt user to fix API key/endpoint
  }
}

Prevention

Run a connection test against the Azure AI Search endpoint after entering credentials.
Avoid relying on error.message substring matching in your own code — prefer error.statusCode when available.

When it happens

Trigger: Any error thrown while constructing the SearchClient or accessing the index during connection, where error.message includes '401' / 'Unauthorized' / 'authentication failed'.

Common situations: Wrong API key; endpoint URL belongs to a different search service; key was revoked or expired in Azure; a query key used where the operation needs an admin key during setup.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/0cf9a8d0a4d2c127. Report an issue: GitHub.