n8n-io/n8n · error · NodeApiError

Authentication failed. Please check your API key or token in

Error message

Authentication failed. Please check your API key or token in the credentials

What it means

Thrown as a NodeApiError during the Chroma collection listSearch when the caught error message contains `Unauthorized`, `401`, or `403`. It signals that the request reached ChromaDB (or Chroma Cloud) but was rejected for credentials reasons. Detection is by string matching on the error message.

Source

Thrown at packages/@n8n/nodes-langchain/nodes/vector_store/VectorStoreChromaDB/VectorStoreChromaDB.node.ts:373

					return { results: [] };
				} catch (error) {
					const errorMessage = error instanceof Error ? error.message : String(error);

					// Check for connection errors
					if (errorMessage.includes('ECONNREFUSED') || errorMessage.includes('Failed to connect')) {
						throw new NodeApiError(this.getNode(), {
							message:
								'Cannot connect to ChromaDB. Please ensure ChromaDB is running and accessible at the configured URL.',
						});
					}

					// Check for authentication errors
					if (
						errorMessage.includes('Unauthorized') ||
						errorMessage.includes('401') ||
						errorMessage.includes('403')
					) {
						throw new NodeApiError(this.getNode(), {
							message:
								'Authentication failed. Please check your API key or token in the credentials',
						});
					}

					throw new NodeApiError(this.getNode(), {
						message: `Failed to list ChromaDB collections: ${errorMessage}`,
					});
				}
			},
		},
	},
	retrieveFields,
	loadFields: retrieveFields,
	insertFields,
	sharedFields,

	async getVectorStoreClient(context, _filter, embeddings, itemIndex) {

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Open the credential in n8n and re-paste the current Chroma Cloud API key (trim any whitespace).
2. Confirm the `Authentication` option matches the credential type (Cloud vs Self-Hosted).
3. For self-hosted behind auth, verify the proxy's required header is being sent and the token hasn't expired.
4. For Cloud, verify the tenant and database values are correct for the API key.

Example fix

// before
if (errorMessage.includes('Unauthorized') || errorMessage.includes('401') || errorMessage.includes('403')) {
  throw new NodeApiError(this.getNode(), { message: 'Authentication failed...' });
}

// after: include the HTTP status when available so the user can distinguish 401 vs 403
const status = (error as { statusCode?: number }).statusCode;
const authHint = status === 401 || status === 403 || /Unauthorized|401|403/.test(errorMessage);
if (authHint) {
  throw new NodeApiError(this.getNode(), {
    message: 'Authentication failed. Please check your API key or token in the credentials',
    description: status ? `HTTP ${status} from ChromaDB` : undefined,
  });
}

// When saving the credential, do a listCollections probe to verify auth before the workflow runs.
async function verifyChromaAuth(client: ChromaClient): Promise<void> {
  try {
    await client.listCollections();
  } catch (error) {
    const msg = error instanceof Error ? error.message : String(error);
    if (/Unauthorized|401|403/.test(msg)) {
      throw new Error('Authentication failed. Please check your API key or token in the credentials');
    }
    throw error;
  }
}

function isAuthError(error: unknown): boolean {
  if (!(error instanceof Error)) return false;
  const status = (error as { statusCode?: number }).statusCode;
  return status === 401 || status === 403 || /Unauthorized|401|403/.test(error.message);
}

try {
  return await chromaClient.listCollections();
} catch (error) {
  if (isAuthError(error)) {
    throw new NodeApiError(node, { message: 'Authentication failed. Please check your API key or token in the credentials' });
  }
  throw error;
}

When it happens

Trigger: Listing collections against Chroma Cloud with an expired or wrong API key; against a self-hosted ChromaDB fronted by an auth proxy returning 401/403; credentials typed into the wrong auth type (e.g. Cloud key used against a Self-Hosted connection).

Common situations: API key regenerated in Chroma Cloud but n8n credential not updated; token paste error (leading/trailing whitespace); Basic-auth header missing on a reverse-proxy that requires it; tenant/database mismatch on Cloud.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Cannot connect to ChromaDB. Please ensure ChromaDB is runnin
• Failed to list ChromaDB collections: ${errorMessage}
• API Key is required for authentication
• Failed to initialize Chroma collection
• Collection must be a string

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/f15325071eb9a6c4. Report an issue: GitHub.