n8n-io/n8n · warning

Unauthorized

Error message

Unauthorized

What it means

Webhook auth backstop in the Microsoft 365 Agent trigger. The Bot Framework authorizeJWT middleware is invoked; if it does not set authorized=true (token missing, expired, wrong audience, or wrong signing key), the node sends HTTP 401 { error: 'Unauthorized' } itself when the middleware didn't already respond, then returns noWebhookResponse. This is not a thrown error — it's an HTTP 401 the trigger emits to the caller.

Source

Thrown at packages/@n8n/nodes-langchain/nodes/vendors/Microsoft/MicrosoftAgent365Trigger.node.ts:241

			const activityCapture: ActivityCapture = {
				input: '',
				output: [],
				activity: {},
			};

			const callback = configureAdapterProcessCallback(this, agent, credentials, activityCapture);

			// authorizeJWT verifies the Bot Framework token (sets req.user) and 401s on failure
			let authorized = false;
			await authorizeJWT(authConfig)(req, res, (err?: unknown) => {
				if (!err) authorized = true;
			});

			if (!authorized) {
				// backstop: ensure a 401 is sent even if the middleware didn't
				if (!res.headersSent) {
					res.status(401).send({ error: 'Unauthorized' });
				}
				return { noWebhookResponse: true };
			}

			await agent.adapter.process(req, res, callback);

			if (
				activityCapture.activity.type === 'event' ||
				activityCapture.input.trimStart().startsWith('<addmember>')
			) {
				return { noWebhookResponse: true };
			}

			let returnData;

			if (node.typeVersion === 1) {
				returnData = activityCapture;
			} else {

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Verify the microsoftAgent365Api credential: appId, tenant, and secret/password match the Azure app registration used by the Bot Framework channel.
2. Ensure the Bot Framework channel's messaging endpoint points at the n8n production webhook URL (production/test URL).
3. Don't hit the webhook URL directly in a browser/curl without a valid Bot Framework token — a 401 here is the correct, expected response to an unauthenticated probe.
4. Check server clock skew (NTP) — large skew fails JWT exp/nbf validation.

// This is server-side JWT validation; emulate the precondition:
// the incoming request MUST carry a valid Bot Framework JWT.
const authHeader = req.headers['authorization'] as string | undefined;
if (!authHeader?.toLowerCase().startsWith('bearer ')) {
  // expect the trigger to respond 401 — do not attempt to process
  res.status(401).send({ error: 'Unauthorized' });
  return;
}

When it happens

Trigger: An incoming Bot Framework request whose JWT fails verification: no Authorization header, expired/revoked token, token signed for a different app id, clock skew, or replay from a non-Microsoft source. Also when the microsoftAgent365Api credential's appId/appPassword (tenant) is misconfigured so the token validation key doesn't match.

Common situations: Wrong appId/appTenant in the credential; the Bot Framework endpoint URL changed and the registration wasn't updated; testing the webhook URL directly from a browser (no token) — expect this 401.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• ${error.message}
• No authentication data defined on node!
• Authorization is required!
• Authorization data is wrong!
• User not authenticated!

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/63f33efc7fc849e4. Report an issue: GitHub.