Resources · n8n integration

JWT n8n integrationAutomate JWT with n8n.

A token stops being a black box once the node opens it. The JWT n8n integration brings 3 operations to a workflow: decode, sign, verify. The key and the algorithm live in a credential created once, and each claim you want inside the payload gets its own field.

Try the JWT integration on n8nSee the 3 operations

Verified Trustpilot reviews · AI, automation & growth agency

Why automate

What does the JWT n8n integration actually do?

JWT stands for JSON Web Token, the format described in RFC 7519. Inside n8n, the JWT n8n integration is a single node with 3 operations on 1 resource: produce a token, check a token, or read what a token holds. Everything happens between that node and a JWT credential, which stores the key and the algorithm.

Start with the case that shows up most often. A workflow has to call a service that only answers to a signed assertion. Sign a JWT builds that token at the moment of the call: you set Expires In, the lifetime in seconds, you name the recipient in Audience, and the token goes to the node that fires the request.

The other direction is just as common. A third-party service calls your n8n Webhook, the URL n8n exposes so an outside system can start a workflow, and the call carries a token. Verify a JWT stands at the door: the check runs first, and the rest of the flow, a row in Postgres or a message in Slack, only runs once the token holds up.

Then there is the dull case that saves an afternoon. A token comes back from somewhere and nobody knows what it carries. Decode a JWT turns it into readable JSON, Return Additional Info adds the header and signature information, and the result can sit in Google Sheets while you work out which claim you actually need.

Values rarely get typed by hand here. They come from an expression, the {{ }} syntax n8n uses to pull a value out of the item coming in, written as {{ $json.field }}. A field marked required blocks the node while it stays empty, which is exactly what Token does on Decode a JWT and on Verify a JWT.

The node covers 3 operations on 1 resource. Outside that catalogue, the HTTP Request node takes over: it calls any endpoint of a tool's API and reuses the same credential through predefined authentication. And if the platform choice is still open, the n8n review walks through it, while the n8n training fits the moment a whole team has to build these flows.

Connect

How do you set up the JWT credential in n8n?

  1. 01

    Create the JWT credential

    In n8n, open the Credentials menu and create a JWT credential. A credential is the container that holds the secret: filled once, it shows up in the dropdown of every node that needs it, in this workflow and the next ones. This one is not limited to the JWT node either, the Webhook node accepts the same credential.

  2. 02

    Choose the Key Type

    Two key types are supported. Passphrase is signed with a secret with an HMAC algorithm, so the credential asks for that Secret. PEM Key targets a private key JWT with an RSA or ECDSA algorithm: you paste a Private Key and a Public Key, both obtained from generating a key pair. Pick the type that matches the key already in your hands.

  3. 03

    Select the Algorithm

    Last field: the Algorithm used to sign the assertion. The credential supports HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512 and none. Save it, open the JWT node, and the credential appears in its list.

Actions

What can the JWT node do in n8n?

The JWT node exposes 3 operations. For each one: the node as you configure it in n8n, the required fields, and our field notes.

01

Decode a JWT

decode

What you see in n8n

Notes & use cases

Feed a token in, get its contents back as JSON the next node can read. Switch on Return Additional Info and you get the complete decoded token, header and signature information included, instead of the payload alone.

Key parameters

  • Token: the token to verify or decode, required, usually an expression pointing at the incoming item, {{ $json.field }}.
  • Return Additional Info: off, you get the payload; on, the header and signature information come with it.
  • Key ID: the optional kid header claim, used to specify the key for validating the signature.
Use cases
a token lands in a workflow and nobody remembers what it carries. Decode it once, read the JSON, then wire the branch that matters.
02

Sign a JWT

sign

What you see in n8n

Notes & use cases

This operation creates a token rather than reading one. Nothing is required: you fill the claims you need, one by one in the Payload Claims collection and its 12 fields, or as JSON when an earlier node prepared the payload.

Key parameters

  • Use JSON to Build Payload: whether to use JSON to build the claims, the object landing in Payload Claims (JSON).
  • Expires In: the lifetime of the token in seconds, 3600 in the placeholder.
  • Audience: identifies the recipients that the JWT is intended for.
Use cases
a scheduled workflow calls a service that expects a signed assertion. Sign the token right before the call, then pass it to the node making the request.
03

Verify a JWT

verify

What you see in n8n

Notes & use cases

Verification is what stands between a token and the rest of the run. The node checks it with the algorithm set in the credential, and the options decide how strict that check gets.

Key parameters

  • Token: required here too, and an empty required field stops the node before anything else happens.
  • Ignore Expiration: whether to ignore the expiration of the token during the check.
  • Clock Tolerance: number of seconds to tolerate when checking the nbf and exp claims, to deal with small clock differences among different servers.
Use cases
a third-party service calls your Webhook. The check runs first, and the rest of the workflow only executes once the token passes.
Need help

Need help automating JWT with n8n?

A person reads every message.

FAQ

JWT and n8n: the questions that come next

01Is the JWT n8n integration free?
Yes. The JWT node ships with n8n, so there is nothing to install and nothing extra to pay on the n8n side. It behaves the same on n8n Cloud, the hosted offer run by n8n, and on a self-hosted instance installed with Docker or npm under the Community Edition and its Sustainable Use license. A workflow built on one runs on the other without changes. The node works on tokens you already produce or receive, and the key material stays in a credential you create yourself. So the cost question comes down to where n8n runs, not to the node.
02What credentials does the JWT node need?
A JWT credential, created once in the Credentials menu and reusable everywhere. It supports 2 key types. With Passphrase, signing happens with a secret and an HMAC algorithm: you enter the Secret, then pick the Algorithm. With PEM Key, you are on a private key JWT with an RSA or ECDSA algorithm: you enter a Private Key and a Public Key obtained from generating a key pair, then pick the Algorithm. That same credential also authenticates the Webhook node, so one entry covers both. Inside the node, each operation can still replace the stored algorithm through its Override Algorithm option.
03What are the limits of the JWT node in n8n?
The node covers 3 operations on 1 resource: Decode a JWT, Sign a JWT and Verify a JWT. Outside that catalogue, the HTTP Request node takes over, calling any endpoint of a tool's API and reusing the same credential through predefined authentication. Two things are worth knowing before building. Token is the required field on Decode a JWT and Verify a JWT, and a required field left empty stops the node from running. Sign a JWT has no required field at all, so the payload holds exactly what you put in it, field by field in the 12 Payload Claims or in one JSON block.
04Does a JWT workflow react in real time?
It depends on what starts the workflow. JWT has no trigger node in n8n, so a workflow built around it starts with another trigger: a Schedule Trigger at a fixed interval, the n8n Webhook node called by a third-party service, or the trigger of another tool already in the flow. The JWT node then runs as a step inside that execution. The tempo is set by the first node: with a Webhook, the reaction follows the incoming call; with a Schedule Trigger, it follows the clock. The signing or the check happens right after.
05n8n or Make for working with JWT?
It comes down to hosting and cost model more than to features. n8n runs on your own server with Docker or npm, or on n8n Cloud, and a workflow is identical either way. Make is a hosted automation platform with no self-hosting option, billed per operation. If the tokens you sign or check sit next to systems kept in house, self-hosting keeps the key material and the data on your side. If you would rather someone else operates the platform and bills per operation, Make answers that. The visual logic differs too, so one real workflow tested on both settles it faster than a feature table.
Same platform

Other docs you might need on this stack.

Browse all integrations