How to secure n8n with OAuth?

The most practical and production‑safe way to “secure n8n with OAuth” is to put n8n behind an external reverse proxy (like OAuth2 Proxy, Cloudflare Access, or a provider's OAuth gateway) and force users to authenticate with OAuth before they can even reach n8n’s UI or webhooks. n8n does not currently provide built‑in OAuth login for its own UI — so the correct approach is securing access at the network/proxy layer.

 

What “Securing n8n with OAuth” Really Means

 

n8n itself does not allow “login with Google” or “login with GitHub” built‑in. The only way to require OAuth before someone reaches the editor, REST API, or webhook endpoints is:

• Place n8n behind a reverse proxy.
• Configure that proxy to enforce OAuth login.
• Only forward authenticated traffic to your n8n instance.

In production, the two most common tools are:

• OAuth2 Proxy (open‑source, works with Google, GitHub, Azure AD, Okta)
• Cloudflare Access (OAuth-based access control for apps behind Cloudflare)

This method is used by real companies running n8n because it fully locks down:

• the n8n editor
• REST API endpoints
• manual workflow triggers
• webhook workflow triggers

 

How to Secure n8n with OAuth Using OAuth2 Proxy

 

This example uses Google OAuth because it’s the most widely used, but the same idea works for GitHub, Azure, Okta, etc.

The flow is simple:

• User visits your n8n URL
• OAuth2 Proxy intercepts the request
• User is redirected to Google for login
• After successful login, Google returns the user to OAuth2 Proxy
• Proxy validates the user, then forwards the request to n8n

 

Docker Compose Example (REAL and working)

 

version: "3.8"

services:
  oauth2-proxy:
    image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
    environment:
      OAUTH2_PROXY_PROVIDER: "google"
      OAUTH2_PROXY_CLIENT_ID: "${GOOGLE_CLIENT_ID}"
      OAUTH2_PROXY_CLIENT_SECRET: "${GOOGLE_CLIENT_SECRET}"
      OAUTH2_PROXY_COOKIE_SECRET: "${COOKIE_SECRET}"   // any random 32-byte base64 string
      OAUTH2_PROXY_EMAIL_DOMAINS: "*"                  // restrict by domain if needed
      OAUTH2_PROXY_UPSTREAMS: "http://n8n:5678"
    ports:
      - "8080:4180"   // expose proxy, not n8n
    depends_on:
      - n8n

  n8n:
    image: n8nio/n8n:latest
    environment:
      N8N_HOST: "localhost"
      N8N_PORT: 5678
      N8N_EDITOR_BASE_URL: "https://your-domain.com"
      N8N_WEBHOOK_URL: "https://your-domain.com"
    expose:
      - "5678"

 

In this setup:

• Your users will access n8n at https://your-domain.com.
• Requests first hit OAuth2 Proxy (port 8080).
• Only authenticated traffic is forwarded to n8n.
• n8n itself is not publicly exposed.

 

Securing Webhooks with OAuth

 

Webhooks are tricky: external services (like Stripe, GitHub, or Notion) cannot perform OAuth login.

To deal with this, you normally do one of these:

• Allowlist only specific webhook URLs in the proxy (bypass OAuth for them)
• Restrict to specific IP ranges (Stripe, GitHub, etc.)
• Place webhooks on a separate subdomain that bypasses OAuth but is still protected by secret URLs + signature validation

This is normal practice because webhooks rely on signatures, not login‑based auth.

 

How to Leave Webhooks Accessible but Protected

 

In OAuth2 Proxy, you can exempt n8n’s webhook endpoints:

OAUTH2_PROXY_SKIP_AUTH_ROUTES: "^/webhook/"

Then you rely on:

• n8n's automatically generated webhook security tokens
• the platform's own signature verification (Stripe, GitHub, etc.)

This keeps the editor fully locked behind OAuth without breaking webhook workflows.

 

Additional Production Recommendations

 

• Always disable n8n’s basic auth if you're using OAuth at the proxy layer.
• Never expose port 5678 to the public.
• Put n8n behind HTTPS only.
• Force all admin access through your OAuth provider.

 

Summary

 

The correct and production‑ready way to secure n8n with OAuth is to put it behind a reverse proxy like OAuth2 Proxy or Cloudflare Access. This proxy forces OAuth login before anyone can reach the n8n editor, API, or any sensitive endpoints. Webhooks can be selectively exempted while remaining secure through tokens and signature validation. n8n does not offer built-in OAuth for its own login, so securing it at the proxy layer is the industry-standard approach and what real production teams use.