Why this matters
Sending one API request is easy, and you did it in the last module. Real workflows break on three other things: the key put somewhere it leaks, a sheet that quietly stops at 100 rows when the CRM has 340, and a nightly run that fails at 2am because it asked too fast.
None of these throw an obvious error at build time. The answers are all in the API doc, in the same few sections, if you know where to look. Ten minutes of reading saves a report that is wrong for weeks before anyone notices.
What you’ll build
Sam at Copperleaf Marketing (made up) wants every client contact from the agency’s CRM in a Google Sheet each night. You read an example API doc for its authentication, endpoint, parameters, rate limit and error codes, decide where the key goes, follow pagination to the last page and decide what the workflow should do with a 200, 401, 429 and 500.
Tidewater CRM and its doc are made up for the lesson, and every screen is a Stepthrough worksheet. Nothing is sent.
What you need
- NothingThe practice is a worksheet in your browser.
- The API doc of one app you use, to do it for realSearch for the app name plus "API docs". Most are public.
Concepts
3 ideas you’ll use in the practice.
Bearer tokens
A bearer token is an API key sent in the Authorization header as Bearer, a space and the key. It works for whoever holds it, like a hotel key card.
Keep it out of URLs, which end up in logs and screenshots. Store it once as a credential: in n8n, a Bearer Auth credential picked in the HTTP Request node. If it leaks, revoke it and make a new one.
Pagination
API pagination means a big list comes back one page at a time, with a cursor or page number for the next one. Send the request again with it until there is no next page.
A sheet with exactly 100 rows, or any other round number, is the giveaway that only page one was read. n8n’s HTTP Request node has a Pagination option that loops for you.
Rate limits and status codes
A rate limit caps how many requests you can send per minute. Go over and you get a 429 Too Many Requests, often with a Retry-After header saying how long to wait.
Read the status code before deciding: 200 carry on, 401 a person fixes the key, 429 wait and retry, 500 retry a few times then alert someone. The error-handling module at the end of this course builds those alerts and retries.
Practice
Do every step yourself in a practice copy of the real tool. It checks your work, and “Do it for me” finishes any step you get stuck on.
Do it for real
Now repeat it in your own account. Tick each step as you go.
Quick check
3 questions to check you’ve got it.
1. Where should the API key go in your n8n workflow?
- At the end of the URL
- In a saved Bearer Auth credential
- In a sticky note on the canvas
Show the answer
In a saved Bearer Auth credential. Stored once, encrypted, and sent as an Authorization header.
2. Your sheet always has exactly 100 contacts, but the CRM has 340. Why?
- The API is broken
- The workflow only reads the first page
- The CRM hides old contacts
Show the answer
The workflow only reads the first page. The API returns 100 per page with a cursor. Follow it to the last page.
3. What does a 429 status code mean?
- The key is wrong
- Too many requests: wait and try again
- The data was not found
Show the answer
Too many requests: wait and try again. 429 is the rate limit. 401 is the key.
What a Webhook Is, in Plain Words
You can ask an API for data the safe way. Next, flip it around: a webhook, where the app sends the data to you the moment it happens.
Start module 7 →