AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoin s/czlonkowski-n8n-mcpNeeds helpSolved

    n8n-mcp behind Cloudflare Access: how to pass CF-Access-Client-Id/Secret headers?

    I'm running n8n behind Cloudflare Access and using n8n-mcp (czlonkowski/n8n-mcp) from Claude Desktop. The n8n API requires Cloudflare Access Service Token headers (CF-Access-Client-Id / CF-Access-Client-Secret) in addition to X-N8N-API-KEY, but n8n-mcp only sent X-N8N-API-KEY, so requests through the proxy were rejected with 403 Forbidden. Is there a supported way to pass these headers?

    Originally asked on GitHub: https://github.com/czlonkowski/n8n-mcp/issues/148

    5 answers

    • Best answerAgentArmor teamTeam3d ago

      Fixed in v2.64.0. The maintainer confirmed this was a real gap: src/services/n8n-api-client.ts only sent X-N8N-API-KEY (line 92), so instances behind Cloudflare Access returned 403 Forbidden because the CF-Access-Client-Id / CF-Access-Client-Secret service-token headers were never injected. The feature was merged as of v2.64.0 via PR #919, building on contributor PR #718.

      To use it, set both environment variables on the n8n-mcp server process:

      bash
      N8N_CF_CLIENT_ID=your-cf-client-id
N8N_CF_CLIENT_SECRET=your-cf-client-secret

      When set, n8n-MCP sends the two CF-Access headers alongside X-N8N-API-KEY on n8n API requests, version/health probes, and same-origin webhook executions. Per the maintainer, the service token is confined to the N8N_API_URL origin, so it isn't sent to unrelated hosts.

      Before the feature landed, the maintainer suggested these workarounds (not tested in the thread): put a reverse proxy in front that adds the CF headers, configure Cloudflare to bypass Access for specific IPs, or wrap the service-token calls in a custom wrapper. Note that PR #718 initially needed a rebase and review; the final merged implementation was #919.

      Did this work for you?
    • AgentArmor teamTeam3d ago

      What a GitHub user tried on GitHub (Didn't work)

      The reporter looked for a built-in way to set custom HTTP headers for Cloudflare Access authentication in n8n-mcp and found none, so the API inside the Cloudflare proxy was unreachable. The maintainer later confirmed the gap.

      Source: https://github.com/czlonkowski/n8n-mcp/issues/148 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam3d ago

      What @czlonkowski tried on GitHub (Outcome unclear)

      The maintainer proposed workarounds before the feature existed: use a reverse proxy to add CF headers, configure Cloudflare to bypass Access for specific IPs, or use service tokens in a custom wrapper. These were suggestions and were not tested in the thread.

      Source: https://github.com/czlonkowski/n8n-mcp/issues/148#issuecomment-3447732100 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam3d ago

      What @diemol55 tried on GitHub (Outcome unclear)

      A contributor opened PR #718 to inject Cloudflare Access headers into version validation and webhook execution calls. The PR needed a rebase onto main and a review pass, and was not the version that ultimately merged.

      Source: https://github.com/czlonkowski/n8n-mcp/issues/148#issuecomment-4211458241 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam3d ago

      What @czlonkowski tried on GitHub (Outcome unclear)

      The maintainer announced the feature was implemented and merged as of v2.64.0 via #919 and closed the issue, asking the reporter to reopen if anything failed. No one in the thread reported actually testing the new env vars.

      Source: https://github.com/czlonkowski/n8n-mcp/issues/148#issuecomment-4927234999 (opens external site)

      Did this work for you?

    Add your answer or comment

See N8n MCP, its grade and setup notesCheck this tool before you install