n8n 2.45.0 Prerelease Adds Public-API Idempotency: Know the Retry Limits

A new control for retried creation requests

n8n published 2.45.0 as a prerelease on October 20, 2026. PR 40978 adds Idempotency-Key support to Public API POST requests. A client retry after a timeout can receive a previously stored successful response instead of running the handler again.

This matters for integrations provisioning workflows or other n8n resources. If a workflow was created but its response was lost, an uncontrolled retry can create another copy. The prerelease adds a control for that scenario, not a recommendation to upgrade production immediately or a promise that duplicates are impossible.

Keys have a lifetime, scope and explicit error cases

The PR describes per-user keys retained for 12 hours. The same key and request replay the first successful response. A different request with that key returns 422; a retry while the original is in progress returns 409. Failed requests release the key for retry.

Only successful responses are retained. Clients should distinguish an in-progress conflict from a changed request, rather than generating new keys and resubmitting every non-200 response. They should not assume deduplication survives beyond the retention window.

The PR also states that stored response bodies remain plaintext JSON. Review database access, retention and response sensitivity rather than assuming separate replay encryption. This report did not execute 2.45.0 or measure duplicate reduction.

API permissions and business deduplication remain separate

Idempotency-Key is not an authentication credential. Public API calls still require an API key with appropriate permissions. n8n documents granular scopes for Enterprise; non-Enterprise keys have broader account access, and the API is unavailable during the free trial.

The genuine Create API Key image is archival, with a July 21, 2025 sample expiry and read-only scopes. It illustrates authorization, does not grant workflow:create and is not an Idempotency-Key switch. No customer credential is shown.

A workflow may call CRM, email, MISA or payment services. Deduplicating an n8n resource-creation request does not automatically deduplicate those downstream business actions. Invoices and payments still need business identifiers and reconciliation.

A small test before integration adoption

Friday Works proposes an owned test instance and sample data: replay an identical creation request, change its body while reusing a key, retry while processing, and exercise a failed request. Check both HTTP status and the actual resource count. These are proposed acceptance cases, not completed test results.

Associate a key with one business intent, preserve the request relationship, back off appropriately and reconcile uncertain outcomes. Do not reuse one key for every order or change keys on every retry of the same order. Review stable-release status and compatibility before production scheduling.

The inline image is an actual n8n API-key list. Both vendor demo images retain their Apache 2.0 plus Commons Clause v1.0 notices. Neither is a fabricated API-response screen or evidence of an unperformed test.