🗺️ The Ultimate AI Automation Roadmap — Part 3 of 20 | Tier: Foundations | Difficulty: Beginner | Est. read: 16 min

Part 3: Mastering REST APIs for Automation — HTTP, OAuth2 & JSON in n8n Without Coding

Search Intent: Every automation tutorial says “just call the API” — but nobody explains how authentication, HTTP methods, and JSON work together. This guide is the missing manual. You’ll understand REST APIs so thoroughly that you can connect n8n to ANY service: CRMs, ERPs, payment processors, government APIs, and custom SaaS tools — even without a native n8n node.

REST API request response cycle diagram for n8n automation workflows — [Image: REST API flow — Client (n8n) sends HTTP Request with Method + URL + Headers + Body → API Server processes → Returns JSON Response with Status Code]

📋 Table of Components

Concept	What It Does	n8n Implementation
GET Request	Read/fetch data	HTTP Request node, Method: GET
POST Request	Create new records	HTTP Request node, Method: POST + JSON body
PUT/PATCH Request	Update existing records	HTTP Request node, Method: PATCH
DELETE Request	Remove records	HTTP Request node, Method: DELETE
API Key Auth	Static token in header	Header: X-API-Key or Authorization: Bearer
OAuth2	Delegated token-based access	n8n built-in OAuth2 Credential
JWT Bearer	Signed token authentication	Header: Authorization: Bearer [token]

🌍 Real-World Scenario: E-Commerce Multi-System Order Sync

A Shopify store syncs every new order to three systems simultaneously: a PostgreSQL database via Supabase REST API (JWT auth), a fulfillment warehouse API (API Key auth), and QuickBooks Online (OAuth2). Each uses a different authentication pattern. One n8n workflow handles all three in a single run by configuring the HTTP Request node differently for each destination.

⚙️ Step 1: The HTTP Request Node Deep Dive

The HTTP Request node is n8n’s universal API connector. Key configuration areas: Method + URL (what and where), Authentication (how to prove identity), Headers (metadata: Content-Type, Accept, custom headers), Query Parameters (filters in the URL: ?page=1&limit=100), Body (JSON, Form Data, or Raw for POST/PUT), and Response Format (JSON auto-parsing or raw text).

// Example: Fetch Shopify orders (API Key in header)
GET https://yourstore.myshopify.com/admin/api/2024-01/orders.json?status=any&limit=50
Headers:
  X-Shopify-Access-Token: shpat_your_access_token
  Content-Type: application/json

// n8n HTTP Request node setup:
// URL: https://{{$env.SHOPIFY_DOMAIN}}/admin/api/2024-01/orders.json
// Method: GET
// Auth: Header Auth → Name: X-Shopify-Access-Token, Value: [credential]
// Query params: status=any, limit=50

⚙️ Step 2: OAuth2 — Google Workspace Integration

OAuth2 is the standard for Google APIs, Salesforce, HubSpot, and Slack. In n8n: go to Credentials → New → Google OAuth2 API. Enter your Google Cloud Console Client ID and Client Secret. Click “Sign in with Google” and authorize access. n8n stores both access_token and refresh_token, automatically refreshing the access_token (which expires every 60 minutes) without any manual intervention. All Google nodes (Sheets, Drive, Gmail, Calendar) use this same credential.

n8n OAuth2 credential setup for Google API authentication — [Image: n8n Credentials panel showing Google OAuth2 API setup with Client ID field, Client Secret field, and blue “Sign in with Google” authorization button]

⚙️ Step 3: JWT Bearer Tokens — Supabase/Custom APIs

Many modern APIs (Supabase, Firebase, custom Node.js APIs) use JWT tokens. In the HTTP Request node: Authentication → Predefined Credential Type → Header Auth. Set Header Name to Authorization, Value to Bearer eyJ.... For Supabase specifically: use the anon key for public operations and the service_role key (with caution — bypasses RLS) for administrative operations from n8n server-side.

⚙️ Step 4: Handling Pagination

APIs rarely return all records in one call. Most use pagination. In n8n: add a Loop with an HTTP Request node inside. After each call, check if there’s a next cursor or if the returned array is full-size (indicating more pages exist). Update the URL parameter (?page={{$vars.page}}) or cursor before the next iteration. Stop when the API returns an empty array or no next link.

// Code node: Check if more pages exist
const response = $input.first().json;
const hasMore = response.orders.length === 50; // Full page = more data
const nextCursor = response.pageInfo?.endCursor;
return [{ json: { ...response, hasMore, nextCursor, currentPage: ($vars.page || 1) + 1 } }];

🔁 Automation Logic: Multi-System Order Sync

Stage	Action	Auth Used
🟢 Trigger	Shopify Order Webhook fires	HMAC webhook signature
⚡ Action 1	POST order to Supabase (database)	JWT Bearer token
⚡ Action 2	POST to warehouse fulfillment API	API Key (X-API-Key header)
⚡ Action 3	POST invoice to QuickBooks Online	OAuth2 (auto-refreshed)
🔍 Filter	Verify all 3 responses returned 201	—
📤 Output	PATCH Shopify order note with all 3 sync IDs	API Key

🚀 Next: Part 4

Part 4 covers JSON data transformation mastery — merging data from multiple API calls, flattening nested objects, using Set/Code/Merge nodes, and reshaping any data structure for seamless automation workflows. We’ll build a complete legal document processing pipeline as our real-world scenario.