n8n API Gateway: Stripe RBAC + Redis Rate Limiting

Secure your n8n webhooks with a Stripe-backed API Gateway (RBAC + Redis rate limiting)

This n8n workflow turns a single n8n webhook into an API Gateway: it authenticates requests using Stripe customer metadata, authorizes them with role-based access control (RBAC), and enforces per-role rate limits via Redis—before forwarding allowed requests to your internal n8n webhook endpoints.

What this workflow does

• Receives a POST request on the gateway webhook including an API key, target route, method, and payload.
• Authenticates against Stripe by searching for a Stripe customer whose metadata.apiKey matches the provided API key, then reads the requester role from metadata.role (e.g., admin, user, readonly).
• Rejects unauthorized requests with a 401 JSON response when no matching Stripe customer is found.
• Authorizes routes via RBAC using a configured route-to-roles permission map; disallowed access returns 403 with a JSON response.
• Enforces per-role rate limits by incrementing a counter in Redis for the current time window and comparing it to the configured limit.
• Throttles over-limit requests with 429 JSON plus a Retry-After header, or forwards allowed requests to the mapped internal n8n webhook URL.
• Responds transparently by returning the internal workflow response and including X-RateLimit-Limit and X-RateLimit-Remaining headers.

Use cases

• SaaS operators exposing controlled API access to n8n workflows with Stripe customer ownership.
• Teams that need strict RBAC for different route permissions (admin vs user vs readonly).
• Protecting expensive automations with Redis-backed rate limits per API key and role.

Technical details

• Integrations: Stripe (search customers), Redis (rate-limit counters)
• n8n nodes used: webhook, if, set, code, redis
• Operational setup: add Stripe credentials with customer search permissions; ensure each customer has metadata.apiKey and metadata.role; provide Redis connectivity; update gateway configuration to match your API routes.