Custom Auth Credential Sends JSON Body Despite application/x-www-form-urlencoded Header

[joannamarquezjohnson]

Bug Description

When using a Custom Auth credential in n8n with the Content-Type header set to application/x-www-form-urlencoded, the request body is still sent as JSON. This causes compatibility issues with APIs that strictly require form-encoded bodies for authentication or token refresh.

To Reproduce

1. Create a Custom Auth credential with the following JSON:

{
  "headers": {
    "Content-Type": "application/x-www-form-urlencoded"
  },
  "body": {
    "grant_type": "refresh_token",
    "client_id": "my-client-id",
    "client_secret": "my-client-secret",
    "refresh_token": "my-refresh-token"
  }
}

2. Use this credential in an HTTP Request node with:

• Method: POST
• URL: https://example.com/oauth2/token

3. Observe that the request fails with a 400 error and a message indicating that required parameters (e.g., client_id) were not supplied.

Expected behavior

The body should be sent as application/x-www-form-urlencoded when the header is explicitly set and the body is defined as key-value pairs.

Debug Info

The body is sent as JSON, which causes the API to reject the request.

Operating System

alpine-minirootfs-3.22.1-x86_64

n8n Version

1.110.0

Node.js Version

22.19

Database

SQLite

Execution mode

main (default)

Hosting

self hosted

[n8n-assistant]

Hey @joannamarquezjohnson,

Thank you for reaching out! We’ve received your issue and are looking into it. To help us track this internally, we’ve created a Linear ticket with the reference: "GHC-5498".

We’ll keep you updated as we make progress, but if you have any additional details or context to share, feel free to add them here - it’s always helpful!

Thanks for your patience and for bringing this to our attention.

---

For INTERNAL use only: GHC-5498

[MookieLian]

Thanks for bringing this up! After reviewing the details, it seems like the behaviour you've reported is actually expected and not a bug. We can understand how this might seem confusing, so we've added a note to clarify things.

If you have any questions or need more details, feel free to reach out again, we're here to help!

Response of HTTP request sent to httpbin.org/post endpoint with Custom Header JSON(application/x-www-form-urlencoded):

  {
    "args": {},
    "data": "",
    "files": {},
    "form": {
      "client_id": "my-client-id",
      "client_secret": "my-client-secret",
      "grant_type": "refresh_token",
      "refresh_token": "my-refresh-token"
    },
    "headers": {
      "Accept": "application/json,text/html,application/xhtml+xml,application/xml,text/*;q=0.9, image/*;q=0.8, */*;q=0.7",
      "Accept-Encoding": "gzip, compress, deflate, br",
      "Content-Length": "109",
      "Content-Type": "application/x-www-form-urlencoded",
      "Host": "httpbin.org",
      "User-Agent": "axios/1.8.3",
      "X-Amzn-Trace-Id": "Root=1-69177468-70bc44f8235cb2cb660d94c2"
    },
    "json": null,
    "origin": "91.99.31.90",
    "url": "https://httpbin.org/post"
  }
]

Note: To send body as JSON instead of form, set header as application/json:

[
  {
    "args": {},
    "data": "{\"grant_type\":\"refresh_token\",\"client_id\":\"my-client-id\",\"client_secret\":\"my-client-secret\",\"refresh_token\":\"my-refresh-token\"}",
    "files": {},
    "form": {},
    "headers": {
      "Accept": "application/json,text/html,application/xhtml+xml,application/xml,text/*;q=0.9, image/*;q=0.8, */*;q=0.7",
      "Accept-Encoding": "gzip, compress, deflate, br",
      "Content-Length": "127",
      "Content-Type": "application/json",
      "Host": "httpbin.org",
      "User-Agent": "axios/1.8.3",
      "X-Amzn-Trace-Id": "Root=1-69185bfb-1da7d28e397d3a484d7afa91"
    },
    "json": {
      "client_id": "my-client-id",
      "client_secret": "my-client-secret",
      "grant_type": "refresh_token",
      "refresh_token": "my-refresh-token"
    },
    "origin": "91.99.31.90",
    "url": "https://httpbin.org/post"
  }
]

#closed:working-as-expected

[Joffcom]

Hey @joannamarquezjohnson

In your http request node are you also setting the content type? The node will typically default to using json which would overwrite the content type in the credential which is kind of expected as mentioned above.

I would say though for oauth it might be better to use the generic oauth option which would handle the refresh for you.