GitHub API in n8n: 401 "Bad credentials", 401 "Requires authentication", 404 "Not Found" and the 403 User-Agent Error

When a GitHub API call from n8n fails with 401 "Bad credentials", 401 "Requires authentication", 404 "Not Found" or a 403 about a missing User-Agent, each message pointed to a different mistake in my tests. The most surprising result was that a wrong token broke a request that works fine without any token, and that a token sent without the Bearer word was silently ignored.

The messages at a glance

What I tested

On 2026-10-25 I sent read-only GET requests to api.github.com with curl. The public repository was octocat/Hello-World. I used made-up tokens only, never a real one.

• A wrong token is worse than no token. The public repository returned 200 with no token, but 401 with a made-up token. If a workflow suddenly fails on public data, a stale or mistyped token is a possible reason.
• A token without the scheme word was ignored. The request returned 200 as if I had sent nothing, which suggests that the header was ignored and the request was treated as anonymous. I did not test the rate limit or a private repository in this case, so I cannot say what that means for your own workflow.
• The 403 was a plain text message, not the JSON error the other cases returned.

Rate limit without a token

The rate limit endpoint showed a limit of 60 requests for requests without a token, and the remaining count went down with each call I made. The GitHub authentication documentation says authenticated requests get a higher limit, but the page I read does not give the number 60. That number is what I observed.

How to send the token

The documentation shows the token in the Authorization header as Bearer YOUR-TOKEN and says token also works in most cases. A request that works like this would look like the following.

curl -H "Authorization: Bearer YOUR_TOKEN" \
-H "User-Agent: my-n8n-workflow" \
https://api.github.com/user

I did not run that command with a real token, so I cannot show the successful response.

A short checklist

1. 401 "Bad credentials": the token is in the right format but GitHub rejected it. Generate a new token and replace the old one. If the call works without a token, remove the token to check.
2. 401 "Requires authentication": the endpoint needs a login and no token reached it. Check that the credential is attached to the node.
3. 404 "Not Found": check the owner and the repository name for typos. The documentation also says requests without a token, or with insufficient permissions, can return 404 or 403 instead of revealing that a private resource exists. I only tested a repository that does not exist.
4. 403 about User-Agent: add a User-Agent header to the request. I used curl to remove it, and I did not check what n8n sends by default.
5. Make sure the header value starts with Bearer (or token) followed by a space and the token.

The documentation also warns that after several failed attempts in a short time, GitHub can temporarily reject all authentication attempts from that user, even valid ones, with a 403. So fix the token before you let a workflow retry in a loop.

Related guides for other APIs: Gemini API key errors and Telegram bot token errors.

What I did not test

• I did not use a real token, so I did not test fine-grained or classic tokens, scopes, expired tokens or single sign-on errors.
• I did not test private repositories, so the 404 behavior for them comes from the documentation, not from my test.
• I used curl. I did not look at how n8n displays these errors or what its GitHub credential sends.
• I tested a few requests on one day, and I did not test the GraphQL API.

Source: GitHub documentation, authenticating to the REST API. The responses above come from my own requests on 2026-10-25.