Connect any API (HTTP, OpenAPI, MCP)

≈ 2 min Extension Web app Bearer Token Basic Auth JWT

These nodes take any credential. The Auth Type decides what AWFlow sends in the Authorization header:

Auth Type	Fields	Sent as
Bearer Token	Bearer Token	Authorization: Bearer <token>
Basic Auth	Username, Password	Authorization: Basic <base64 of username:password>
JWT	JWT	Authorization: <value>, exactly as typed. Use it for schemes like Token abc123.
OAuth2	Client ID, Client Secret	Only for Google and Microsoft 365. See Connect Google.

Before you start

• The API’s documentation: it says how it expects the key (header, query or Basic Auth).

Used by

• Http Request
• HTTP Request Tool
• Custom API
• RSS Feed Read
• MCP Client Tool
• Crypto (HMAC)

Pick a method

Method	Use it when
Bearer token Recommended	Most modern APIs: “send Authorization: Bearer YOUR_KEY”. Also MCP servers that need a login.
Basic Auth	“Use your username and password”, or an API key plus secret sent as Basic Auth.
Raw header value (JWT)	The API wants another scheme in Authorization, such as Token abc123, or a JWT you got elsewhere.

Set it up

Bearer token (recommended)

1. Create a key in the service’s developer settings.

2. Save it in AWFlow. Open Credentials and click Add Credential (or + Add Credential in the node’s Authentication field), then fill the New Credential form. In the browser side panel the form comes in two steps: tap Simple Credential (or click Continue), then fill the rest.

   123456

   1. 1 Step 1:Keep it a simple credential Leave Integration App / Service on Select an integration..., or pick Simple Credential at the top of its list.
   2. 2 Step 2:Name it For example Acme API – read only. A Description is optional.
   3. 3 Step 3:Set Auth Type to Bearer Token Open Auth Type and choose Bearer Token.
   4. 4 Step 4:Paste the key Paste the key into Bearer Token, without the word Bearer.
   5. 5 Step 5:Check where it is saved Signed in, choose Local (this browser only) or Cloud (synced to your account) under Storage location. Without an account it is saved locally in this browser, as here.
   6. 6 Step 6:Click Create Credential Check: the credential is listed on the Credentials page, ready to pick in nodes.

   Numbered areas in the screenshot: 1. Integration App / Service: none (Simple Credential); 2. Name; 3. Auth Type: Bearer Token; 4. Bearer Token; 5. Where the secret is stored (here, locally in this browser); 6. Create Credential.

3. Pick it in the node: Authentication on Http Request, HTTP Request Tool and RSS Feed Read; Credential on Custom API; Authentication next to the server on MCP Client Tool.

Check it's connected — 

Click Test step on the node: the response comes back with status 200 instead of 401.

Basic Auth

1. Save it in AWFlow. Open Credentials and click Add Credential (or + Add Credential in the node’s Authentication field), then fill the New Credential form. In the browser side panel the form comes in two steps: tap Simple Credential (or click Continue), then fill the rest.

   1234567

   1. 1 Step 1:Keep it a simple credential Leave Integration App / Service on Select an integration..., or pick Simple Credential at the top of its list.
   2. 2 Step 2:Name it For example Acme API – basic. A Description is optional.
   3. 3 Step 3:Set Auth Type to Basic Auth Open Auth Type and choose Basic Auth.
   4. 4 Step 4:Fill Username Type the Username the API gave you.
   5. 5 Step 5:Fill Password Type the matching Password.
   6. 6 Step 6:Check where it is saved Signed in, choose Local (this browser only) or Cloud (synced to your account) under Storage location. Without an account it is saved locally in this browser, as here.
   7. 7 Step 7:Click Create Credential Check: the credential is listed on the Credentials page, ready to pick in nodes.

   Numbered areas in the screenshot: 1. Integration App / Service: none (Simple Credential); 2. Name; 3. Auth Type: Basic Auth; 4. Username; 5. Password; 6. Where the secret is stored (here, locally in this browser); 7. Create Credential.

2. Pick it in the node, the same way as a bearer token.

Check it's connected — 

Click Test step: the response comes back without a 401.

Raw header value (JWT)

1. Save it in AWFlow. Open Credentials and click Add Credential (or + Add Credential in the node’s Authentication field), then fill the New Credential form. In the browser side panel the form comes in two steps: tap Simple Credential (or click Continue), then fill the rest.

   123456

   1. 1 Step 1:Keep it a simple credential Leave Integration App / Service on Select an integration..., or pick Simple Credential at the top of its list.
   2. 2 Step 2:Name it For example Acme API – token scheme. A Description is optional.
   3. 3 Step 3:Set Auth Type to JWT Open Auth Type and choose JWT.
   4. 4 Step 4:Paste the header value Paste the full header value (for example Token abc123) into JWT, exactly as copied.
   5. 5 Step 5:Check where it is saved Signed in, choose Local (this browser only) or Cloud (synced to your account) under Storage location. Without an account it is saved locally in this browser, as here.
   6. 6 Step 6:Click Create Credential Check: the credential is listed on the Credentials page, ready to pick in nodes.

   Numbered areas in the screenshot: 1. Integration App / Service: none (Simple Credential); 2. Name; 3. Auth Type: JWT; 4. JWT; 5. Where the secret is stored (here, locally in this browser); 6. Create Credential.

2. Pick it in the node. For a key in another header (X-API-Key) or in the query string, see the note below.

Check it's connected — 

Click Test step: the response comes back without a 401.

Key in another header or in the query string? On Custom API, a Bearer Token credential is sent the way the API’s spec says (in the named header such as X-API-Key, or as a query parameter such as ?api_key=). On Http Request, add the header under the node’s headers instead, but keep in mind that values typed into a node travel with the workflow when you share it.

Signing with HMAC. The Crypto node’s HMAC Key reads the secret from a credential so it never travels with a shared workflow. Use a Bearer Token (or JWT) credential holding only the secret.

Where your token lives

Where your token lives — 

The credential is stored where you choose when you create it:

• Local (this browser only): encrypted in this browser. The encryption key is kept on the same device, so turn on the local secret vault to lock it with a passphrase only you know.
• Cloud (synced to your account): sent over an encrypted connection and stored encrypted on AWFlow’s server, so it works on your other devices.

When a step runs, your browser sends it only to only the address you call in the node. AWFlow’s servers never relay the call.

Privacy & your data →

Common issues

• 401 Unauthorized. The Auth Type doesn’t match what the API expects: Bearer for Authorization: Bearer, Basic Auth for username and password, JWT for any other scheme.
• The API says the key is malformed. You pasted Bearer … into a Bearer Token credential. Paste only the key: AWFlow adds the word.
• 403 Forbidden. The key is valid but lacks access to this endpoint. Check its permissions in the service.
• The MCP server shows as unavailable. The server URL is wrong or the credential was deleted. Pick it again next to the server.

Related

Http Request node

All connections

Create and manage credentials

Privacy & your data