Any API in the world:
┌────────────────────────────┐
│  HTTP Request Node          │
│                             │
│  Method: GET/POST/PUT/DELETE│
│  URL: https://api.service.com/endpoint
│  Headers: Authorization, Content-Type
│  Body: JSON payload         │
│  Authentication: API Key / OAuth / Bearer
│                             │
│  → Returns JSON response    │
└────────────────────────────┘

If a service has an API, you can connect n8n to it.
No built-in node required.

SPEED-READ API DOCS (10 minutes)

1. Find "Authentication" section first
   → API Key? Bearer Token? OAuth? Basic Auth?
   → Where does the key go? Header? Query param?

2. Find the endpoint you need
   → Usually organized by resource: /orders, /customers, /products
   → Look for the HTTP method: GET /orders = list orders

3. Check required parameters
   → Which fields are required vs. optional?
   → What format? (string, integer, ISO date)

4. Look at the response example
   → What JSON structure comes back?
   → Where is the data you need? (often nested: response.data.items)

5. Check rate limits
   → How many calls per minute/hour?
   → What happens if you exceed? (429 error)

USE CASE: Verify a JazzCash payment when a webhook hits

[Webhook: /verify-jazzcash-payment]
    │
    ▼
[HTTP Request Node]
    Method: POST
    URL: https://sandbox.jazzcash.com.pk/ApplicationAPI/API/2.0/Purchase/DoMWalletTransaction
    Headers:
      Content-Type: application/json
    Body (JSON):
      {
        "pp_Language": "EN",
        "pp_MerchantID": "{{$env.JAZZCASH_MERCHANT_ID}}",
        "pp_Password": "{{$env.JAZZCASH_PASSWORD}}",
        "pp_TxnRefNo": "{{$json.transaction_ref}}",
        "pp_Amount": "{{$json.amount}}",
        "pp_TxnDateTime": "{{$now.format('YYYYMMDDHHmmss')}}",
        "pp_SecureHash": "{{$json.computed_hash}}"
      }
    │
    ▼
[IF Node: Response code === "000" (success)]
    │
    ├── YES → [Google Sheets: Log verified payment]
    │         [Gmail: Send receipt to customer]
    │
    └── NO  → [Gmail: Alert — payment verification failed]
              [Google Sheets: Log failed attempt]

[Schedule Trigger: Every 15 minutes]
    │
    ▼
[HTTP Request: Get new orders]
    Method: GET
    URL: https://api.daraz.pk/rest/orders/get
    Headers:
      Authorization: Bearer {{$env.DARAZ_ACCESS_TOKEN}}
    Query Parameters:
      created_after: {{$now.minus(15, 'minutes').toISO()}}
      status: pending
      limit: 50
    │
    ▼
[Split In Batches: Process each order]
    │
    ▼
[Google Sheets: Append order row]
    │
    ▼
[WATI: Send WhatsApp to customer]
    │
    ▼
[Slack: Notify fulfillment team]

[Webhook: /ai-process]
    │
    ▼
[HTTP Request: Call Gemini API]
    Method: POST
    URL: https://generativelanguage.googleapis.com/v1/models/gemini-2.5-flash:generateContent
    Headers:
      Content-Type: application/json
      x-goog-api-key: {{$env.GEMINI_API_KEY}}
    Body:
      {
        "contents": [{
          "parts": [{
            "text": "Summarize this customer feedback in 2 sentences: {{$json.feedback}}"
          }]
        }]
      }
    │
    ▼
[Set Node: Extract AI response]
    summary = {{$json.candidates[0].content.parts[0].text}}
    │
    ▼
[Google Sheets: Save feedback + AI summary]

HTTP Request Node:
  Authentication: Generic Credential Type
  Generic Auth Type: Header Auth

  Header Auth:
    Name: X-API-Key (or Authorization)
    Value: your-api-key-here

  OR use n8n Credentials:
    Go to Credentials → Add → Header Auth
    This stores the key securely and reuses across workflows

HTTP Request Node:
  Authentication: Generic Credential Type
  Generic Auth Type: Header Auth

  Header:
    Name: Authorization
    Value: Bearer your-token-here

n8n Credentials:
  1. Go to Credentials → Add → OAuth2 API
  2. Enter:
     - Client ID: (from Google/Facebook developer console)
     - Client Secret: (from developer console)
     - Authorization URL: https://accounts.google.com/o/oauth2/auth
     - Token URL: https://oauth2.googleapis.com/token
     - Scope: https://www.googleapis.com/auth/spreadsheets
  3. Click "Connect" → authorize in browser
  4. Token auto-refreshes — n8n handles this

// Function Node: Generate HMAC signature
const crypto = require('crypto');

const secret = $env.JAZZCASH_INTEGRITY_SALT;
const dataString = [
  $json.pp_Amount,
  $json.pp_DateTime,
  $json.pp_MerchantID,
  $json.pp_TxnRefNo
].sort().join('&');

const hmac = crypto.createHmac('sha256', secret);
hmac.update(dataString);
const hash = hmac.digest('hex');

return [{ json: { ...$json, pp_SecureHash: hash } }];

[Set Node: Initialize]
    page = 1
    all_results = []
    │
    ▼
[Loop: While has_more === true]
    │
    ├──▶ [HTTP Request: GET /api/items?page={{page}}&limit=100]
    │    │
    │    ▼
    │    [Merge: Add results to all_results]
    │    │
    │    ▼
    │    [IF: response.length === 100]
    │    │
    │    ├── YES → page = page + 1 → [Loop back]
    │    └── NO  → has_more = false → [Exit loop]
    │
    ▼
[Continue with all_results]

Some APIs use cursors instead of page numbers:

[HTTP Request: GET /api/items?cursor={{cursor}}&limit=100]
→ Response includes: { data: [...], next_cursor: "abc123" }
→ Use next_cursor for the next request
→ When next_cursor is null/empty → you've got everything

HTTP Request Node Settings:
  → On Error: Continue (don't stop workflow)
  → Retry On Fail: Yes
  → Max Retries: 3
  → Wait Between Retries: 2000ms (2 seconds)

This handles temporary failures (network blips, 500 errors)
without crashing your entire workflow.