n8n-io/n8n · error

HARDCODED_CREDENTIALS

HARDCODED_CREDENTIALS

Error message

'${node.name}' has a hardcoded value for sensitive header "${header.name}". Should create credentials, setting genericAuthType to httpTemplatedCustomAuth (or reuse an existing httpHeaderAuth/httpBearerAuth credential).

What it means

Error "'${node.name}' has a hardcoded value for sensitive header "${header.name}". Should create credentials, setting genericAuthType to httpTemplatedCustomAuth (or reuse an existing httpHeaderAuth/httpBearerAuth credential)." thrown in n8n-io/n8n.

Source

Thrown at packages/@n8n/workflow-sdk/src/workflow-builder/plugins/validators/http-request-validator.ts:91

		}

		// Check header parameters for sensitive headers
		const headerParams = params.headerParameters as
			| { parameters?: Array<{ name?: string; value?: unknown }> }
			| undefined;

		if (headerParams?.parameters) {
			for (const header of headerParams.parameters) {
				const headerValueStr =
					typeof header.value === 'string' ? header.value : JSON.stringify(header.value);
				if (
					header.name &&
					isSensitiveHeader(header.name) &&
					header.value &&
					!containsExpression(headerValueStr)
				) {
					issues.push({
						code: 'HARDCODED_CREDENTIALS',
						message: `'${node.name}' has a hardcoded value for sensitive header "${header.name}". Should create credentials, setting genericAuthType to httpTemplatedCustomAuth (or reuse an existing httpHeaderAuth/httpBearerAuth credential).`,
						severity: 'warning',
						nodeName: node.name,
						parameterPath: `headerParameters.parameters[${header.name}]`,
					});
				}
			}
		}

		// New plain generic credentials are steered to Templated Custom Auth: a
		// provider documenting `Authorization: Bearer <token>` reliably lures the
		// model into httpBearerAuth, and setup rejects that for new credentials.
		const genericAuthType = params.genericAuthType;
		if (
			params.authentication === 'genericCredentialType' &&
			typeof genericAuthType === 'string' &&
			TEMPLATABLE_PLAIN_AUTH_TYPES.has(genericAuthType)
		) {

View on GitHub (pinned to 5ac6606e81)

When it happens

Trigger: Thrown at packages/@n8n/workflow-sdk/src/workflow-builder/plugins/validators/http-request-validator.ts:91 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/5f03d4815d2b7e27. Report an issue: GitHub.