Connect n8n to Atlas Labs

To connect n8n to Atlas Labs, use a Webhook node as the trigger and an HTTP Request node with a Bearer Auth or Header Auth credential for calls. A self-hosted n8n on its default port will be refused, because Atlas Labs only delivers to public HTTPS on port 443, so put it behind a tunnel or a reverse proxy first.

How do I receive Atlas Labs events in n8n?

1. Add a trigger → Webhook. Set HTTP Method to POST. Copy the Production URL; the Test URL only works while “Listen for Test Event” is active.
2. Options → Raw Body: on, so the Code node can verify the signature against the exact bytes. Respond decides what Atlas Labs sees. At “Immediately” n8n answers 200 “Workflow got started” before any other node runs, well inside the 5-second window, but a failure later in the workflow is then invisible to Atlas Labs. The other Respond modes (“When Last Node Finishes”, or a Respond to Webhook node) answer after the run, which must then finish inside those 5 seconds; what status a failed run returns in those modes is not something we have confirmed, so test it once with the ping and read GET /webhooks/{id}/deliveries.
3. Subscribe the Production URL with either key. On n8n Cloud the host is *.app.n8n.cloud, which Atlas Labs recognises. Self-hosted: the URL must be public https:// on port 443, so http://localhost:5678/webhook/… is refused with port_not_allowed; put n8n behind a tunnel or reverse proxy and check n8n's WEBHOOK_URL setting, which decides the public address its Production URL shows.

   Method

   POST

   URL

   https://automationatlas.io/labs/api/v1/webhooks

   Headers

   Authorization: Bearer lab_off_YOUR_KEY
Content-Type: application/json

   Body

   {"url": "https://<your-n8n-host>/webhook/atlas-labs-sales-order-accepted", "events": ["office.sales_order.accepted"]}

4. Publish (activate) the workflow so the Production URL is registered, then send the test ping (POST /webhooks/{id}/test). The subscription turns active once n8n answers 2xx.
5. Verify and parse in a Code node. In a Code node placed directly after the Webhook node, headers arrive in $json.headers; with Raw Body on, the unparsed string arrives under the body (community reports vary by version, so check once in your n8n). Paste the verify function below without its two import lines and the export keyword, replace process.env.ATLAS_WEBHOOK_SECRET with the secret from a credential or variable you keep in n8n rather than a whsec_ value pasted into the code, and throw when it returns false; how node:crypto is loaded inside an n8n Code node, and whether your instance allows it, is not something we have confirmed (n8n also has a Crypto node). Then parse the string so later nodes have fields: const event = JSON.parse(raw) and return id, type and data.sales_order_id. With Respond at “Immediately” the throw only stops the execution; Atlas Labs already received 200 and will not retry. Whether the throw reaches Atlas Labs as a non-2xx under the other Respond modes, and so triggers the retries after 10 s, 60 s and 300 s, is not something we have confirmed.

// Receive and verify an Atlas Labs webhook (Node 20+, no dependencies).
// Standard Webhooks: headers webhook-id, webhook-timestamp, webhook-signature.
// signature = "v1," + base64(HMAC-SHA256(key, `${id}.${timestamp}.${rawBody}`)), where key is
// the base64-decoded part of your whsec_ secret. During the 24 h after rotate-secret the header
// holds two space-separated values ("v1,<new> v1,<old>"); accept either.
import { createHmac, timingSafeEqual } from "node:crypto";
import { createServer } from "node:http";

const SECRET = process.env.ATLAS_WEBHOOK_SECRET; // whsec_...
const TOLERANCE_S = 300;

export function verify(secret, headers, rawBody, nowS = Math.floor(Date.now() / 1000)) {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  const header = headers["webhook-signature"];
  if (!id || !timestamp || !header) return false;
  if (Math.abs(nowS - Number(timestamp)) > TOLERANCE_S) return false; // stale or replayed
  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = createHmac("sha256", key).update(`${id}.${timestamp}.${rawBody}`, "utf8").digest();
  return header.split(" ").some((part) => {
    const [version, value] = part.split(",");
    if (version !== "v1" || !value) return false;
    const given = Buffer.from(value, "base64");
    return given.length === expected.length && timingSafeEqual(given, expected);
  });
}

// …

How do I call the Atlas Labs API from n8n?

1. Add node → HTTP Request. Set Method and URL, for example GET https://automationatlas.io/labs/api/v1/office/sales-orders/<id> to read the accepted order's quantity and due_sim_day.
2. Authentication → Generic Credential Type → Bearer Auth. Paste only the key; n8n sends Authorization: Bearer …. Or choose Header Auth with Name Authorization and Value Bearer lab_off_YOUR_KEY. Create two credentials, “Atlas Labs Head Office” and “Atlas Labs Factory”, and reuse them.
3. For a write, Send Body → JSON and Send Headers → Idempotency-Key mapped to the Code node's id output, or to the Webhook node's header by node name, $('Webhook').item.json.headers['webhook-id'] (check the node name in your workflow); both are the event id. In this node $json is the previous node's output, the GET-order response, so $json.headers["webhook-id"] would be empty here. Set the key in a node before the request rather than with an expression that changes on each try, so retries reuse it.

   Method

   POST

   URL

   https://automationatlas.io/labs/api/v1/factory/work-orders

   Authentication

   Bearer Auth credential holding lab_fac_YOUR_KEY

   Send Headers

   Idempotency-Key = the Code node's id (the event id)

   Send Body (JSON)

   {"sales_order_id": "<sales_order_id from the Code node>", "quantity": <from the order>, "due_date": <due_sim_day from the order>}

   Preset matters. Pick a preset with a manual bridge (Standard or Full) or this write returns 409 already_bridged, because Starter bridges automatically.

4. Shortcut: Parameters → Import cURL. Paste a curl command from the REST page; it overwrites the node's configuration. Values import as strings, so switch the body from “Using Fields Below” to “Using JSON” to keep numbers as numbers.
5. Treat 409 already_bridged as success in an IF node (201 or 409 with error.code = already_bridged); anything else should fail the execution.

Idempotency and retries

• Money and stock routes are idempotent through Idempotency-Key, so Retry On Fail is safe when the same key is sent on each try.
• The node's Wait Between Tries is short, so for 429 rate_limited read the Retry-After header and use a Wait node, or space calls with HTTP Request Batching (Items per Batch, Batch Interval). The numeric limits of Max Tries and Wait Between Tries are not stated on the node's docs page.
• A reported n8n bug (1.35.0) skips retries when On Error is set to a Continue option; keep On Error at its default while retrying.

Common errors

Gotchas

Download the workflow

What the template needs. It reads its settings from $env.ATLAS_LABS_BASE_URL, $env.ATLAS_LABS_OFFICE_KEY, $env.ATLAS_LABS_FACTORY_KEY and $env.ATLAS_LABS_WEBHOOK_SECRET, and calls require('crypto') in a Code node, so it is written for a self-hosted n8n. From the second major version of n8n, N8N_BLOCK_ENV_ACCESS_IN_NODE defaults to true (its breaking-changes page says so), so set it to false for $env to work in the Code node; that page also advises credentials rather than environment variables for sensitive data. Importing built-in modules is off unless NODE_FUNCTION_ALLOW_BUILTIN is set, so set it to crypto. Code nodes run on task runners by default in that version; whether the main-process variable is enough with the default internal runner is not something we have confirmed, and with an external runner the setting belongs in the runner's own environment. n8n's Code node page says Cloud includes crypto, but whether you can set environment variables on Cloud is not something we have confirmed, so on Cloud you would replace the $env lookups with values you type in yourself. Leave the Webhook node's Raw Body option off: unlike the hand-built recipe above, the template verifies the signature against the parsed body re-serialised with JSON.stringify. Atlas Labs builds each webhook body with JSON.stringify, so it is compact JSON with no extra whitespace and re-serialising reproduces the same bytes. That n8n then delivers the parsed JSON at $json.body is not something we have confirmed against n8n's own documentation.

Questions people ask

Why does my local n8n webhook get port_not_allowed or hostname_not_public?

Atlas Labs only delivers to public HTTPS on port 443. Use n8n Cloud, or put self-hosted n8n behind a tunnel or reverse proxy with a public hostname.

How do I import the workflow?

Download the JSON above and import it from the n8n editor, then open each HTTP Request node and attach your credentials. The file was checked for n8n's export shape but has not yet been imported into a live n8n; tell us if a node needs a nudge.

Can n8n import the Atlas Labs OpenAPI file?

No. The HTTP Request node only imports a curl command. Paste one from the REST page.

Which credential type should I use?

Bearer Auth, with the key alone. Header Auth works too if you type Bearer before the key yourself.

Does the Webhook node verify Standard Webhooks signatures?

No. Its own Authentication options (Basic, Header, JWT) are for callers who can send credentials, which Atlas Labs does not. Verify in a Code node as shown.

Why didn't Atlas Labs retry when my Code node threw?

Because Respond was “Immediately”, so n8n had already answered 200. The other Respond modes (“When Last Node Finishes”, or a Respond to Webhook node) answer after the run; we have not confirmed what status a failed run returns in them, so test once with the ping and check GET /webhooks/{id}/deliveries. Either way the run must finish within 5 seconds.

Sources (checked 15 Oct 2026): docs.n8n.io, HTTP Request node, HTTP Request credentials, Webhook node, node settings (Retry On Fail), HTTP Request common issues, rate limits. Atlas Labs facts from the API source, observed live.