error fix
N8N Credential Error
An n8n credential error usually means the selected credential type, authentication method, scopes, test request, or external service settings do not match what the node needs.
Match your incident first
Start with the symptom you can prove
OAuth provider says redirect_uri_mismatch
First check: Copy the callback URL from the credential screen and compare scheme, host, path, and trailing slash.
Wrong fix to avoid: Do not guess the callback path from memory or old screenshots.
Verify: Provider redirects back to n8n and the credential test passes.
Credential works in editor but fails in production execution
First check: Check credential test, scopes, token refresh errors, and worker/main env consistency.
Wrong fix to avoid: Do not recreate the workflow before testing the credential independently.
Verify: A production execution using the credential succeeds on the same node.
Credentials type is not known
First check: Compare installed node packages and n8n version across main and worker containers.
Wrong fix to avoid: Do not import workflows into production until the credential type exists there.
Verify: The credential type appears in the UI and a test execution can load it.
- Use when
- n8n workflows, credentials
- First check
- Check the trigger node, credentials, production URL or schedule, then verify a production execution exists.
- Time to check
- 5-10 minutes
- Next step
- Match the symptom, then run the verification checks.
Independent third-party notes. n8n is a trademark of its owner and is referenced only for compatibility and troubleshooting context.
Quick Answer
An n8n credential error usually means the selected credential type, authentication method, scopes, test request, or external service settings do not match what the node needs.
Does this match your symptom?
Workflow will not activate
Manual runs work, but the workflow cannot become active or does not run automatically from a real trigger.
First check: Check the trigger node, credentials, production URL or schedule, then verify a production execution exists.
Version awareness
Last reviewed 2026-05-21
Key Facts
- Credential library
- n8n documents many built-in credential types for app nodes.
- HTTP Request option
- HTTP Request can use predefined credential types or generic credentials for custom APIs.
- Custom node issue
- For custom nodes, unknown credential type errors can come from credential class names and package metadata.
- Security note
- Credentials are sensitive and should not be hard-coded into public workflows.
Production Diagnostic Matrix
Turn checks into a brief| Exact symptom or log | Likely cause | First check | Wrong fix to avoid | Verification |
|---|---|---|---|---|
| OAuth provider says redirect_uri_mismatch | Provider app redirect URI does not exactly match the callback URL n8n generated. | Copy the callback URL from the credential screen and compare scheme, host, path, and trailing slash. | Do not guess the callback path from memory or old screenshots. | Provider redirects back to n8n and the credential test passes. |
| Credential works in editor but fails in production execution | Token expired, scope missing, worker cannot decrypt credential, or different runtime env is used. | Check credential test, scopes, token refresh errors, and worker/main env consistency. | Do not recreate the workflow before testing the credential independently. | A production execution using the credential succeeds on the same node. |
| Credentials type is not known | Custom/community node package is missing on one runtime or after upgrade. | Compare installed node packages and n8n version across main and worker containers. | Do not import workflows into production until the credential type exists there. | The credential type appears in the UI and a test execution can load it. |
| OAuth callback reaches n8n but returns 404 or wrong host | Public URL, reverse proxy, or base URL settings are inconsistent with provider settings. | Check WEBHOOK_URL/public editor URL and proxy forwarded host/proto headers. | Do not add multiple provider redirect URIs before proving which URL n8n actually emits. | The callback uses the public HTTPS domain and lands on the credential completion screen. |
| Provider accepts callback but API calls return 403 | OAuth scopes are insufficient or the app was approved with old permissions. | Compare requested scopes with the API action the node is trying to perform. | Do not store broader scopes than needed without documenting the reason. | A minimal API action using the same credential succeeds with the required scope. |
Recommended Steps
- Confirm the node is using the intended credential type.
- Open the relevant credential documentation for the service or node.
- Check required scopes, region, domain, API key, OAuth redirect, or account permissions.
- Use the credential test option when available.
- For custom nodes, verify the credential class name matches the node credential reference.
Verification
- The credential test succeeds where supported.
- The node can perform a low-risk read operation.
- A failed workflow no longer reports authentication or unknown credential type errors.
Warnings
- Do not paste API keys directly into node fields that should use credentials.
- OAuth credentials can fail because of external app settings, not only because of n8n.
Common Mistakes
- Using generic HTTP credentials when a predefined credential type exists.
- Missing OAuth scopes required for the chosen operation.
- Testing with an account that lacks access to the target workspace, base, sheet, or project.
- For custom nodes, mismatching the credential name in the node and credential class.
Examples
Credential type correct: yes
External app permissions/scopes correct: yes
Credential test passes: yes
Low-risk read operation works: yes
Write operation tested safely: yesFAQ
Why does the same credential work in one node but not another?
The second node may need different scopes, resource permissions, account context, region, or operation-specific access.
Is every credential error fixed inside n8n?
No. Many credential problems require changing the external app, OAuth app, API key permissions, or account role.