NOVIX / Reliability guides
Recover n8n OAuth and Credential Failures Behind 401/403 Errors
A 401 or 403 does not always mean “retry harder.” First separate expired/revoked credentials from missing scopes, account permissions, endpoint changes, and provider-side policy changes.
1. Isolate the first failing request
Use the failed execution to identify the exact workflow, node, request, status code and timestamp. Record only privacy-safe evidence; do not paste access tokens or secrets into tickets or logs.
2. Re-authorize before replaying
If the provider credential is expired or revoked, reconnect it through the supported credential flow. If authorization succeeds but the node still returns 403, verify scopes, resource ownership and account-level permissions before changing retry settings.
3. Replay with duplicate protection
When the failed execution contains a create/send/update action, confirm an idempotency key or durable processed-event key exists before retrying. A partially completed execution can otherwise duplicate side effects.
4. Add an observable failure path
Route terminal credential failures to an error workflow or alert that includes workflow name, failed node, execution reference and a safe error summary. The objective is to detect credential drift before missed leads or orders accumulate.
5. Recovery acceptance test
- Reconnect the credential without exposing secrets.
- Replay one known failed execution.
- Confirm the protected side effect occurs no more than once.
- Force a bad credential in a test workflow and confirm the alert fires.
- Document who owns re-authorization and where the credential is used.
When a manual retry is appropriate
n8n lets operators retry failed workflow executions using the currently saved workflow or the original workflow. Use that only after the credential or permission problem is corrected and duplicate safety is understood.
Reference: n8n documentation — retry failed workflows.
For reusable error handling, retry and duplicate-prevention assets, see the n8n Reliability Kit. For a broken production workflow, use the fixed-scope recovery service.
This is generic operational guidance. OAuth behavior, token lifetimes and permissions are controlled by each provider and must be checked against that provider's current API documentation.