Call vLLM and other OpenAI-compatible endpoints from n8n

Private models only help if your automations can reach them. n8n’s verified generic path is its HTTP Request node. It can call a vLLM OpenAI-compatible server or another deployment that actually exposes and accepts POST /v1/chat/completions.

Use this operator guide to wire the HTTP call, authenticate it, set timeout budgets that reflect measured local inference, and keep the model service away from untrusted networks.

If you are still choosing whether n8n is the right automation layer, start with n8n vs Zapier vs Make. For agent-shaped workflows on top of that plumbing, see your first AI agent in n8n.

An OpenAI-compatible endpoint that is reachable from the public internet without authentication is an open inference proxy. Anyone who finds it can consume GPU time. With vLLM, attackers may also reach inference and operational routes that --api-key does not protect. Prompt leakage is a separate logging and access-control risk, not an automatic property of the chat route. Bind to private networks. Require authentication at the gateway. Do not port-forward “just for a demo.”

What “OpenAI-compatible” means here

For n8n purposes, the contract is narrow:

• Base URL points at the server root or /v1, depending on how the node expects it.
• Chat calls hit /v1/chat/completions (or the equivalent path your node appends).
• Request body looks like a chat completion: model, messages, optional temperature, max_tokens, and so on.
• Response returns choices with message content the node can parse.

You do not need feature parity with every OpenAI product surface. You need a chat-completion route whose request, authentication, model identifier, and response shape you have tested from n8n.

vLLM documents this OpenAI-compatible server mode; other runtimes advertise similar shapes. Verify the route and a sample curl against your installation before you wire production workflows. The interface is common, but routes, model identifiers, authentication, and response compatibility can change between products and versions.

The verified n8n path: HTTP Request

Current first-party n8n documentation does not establish a custom base URL for the OpenAI credential or OpenAI Chat Model node. Treat any such field in a particular n8n version or community node as version-specific until you verify it. The documented generic path is the HTTP Request node, which gives you explicit control over the method, URL, headers, body, authentication, and node retry settings.

Use a generic bearer or header credential rather than embedding a secret in the workflow. The credential must contain a value the inference service or its gateway actually validates. A placeholder key on a LAN-only endpoint is not authentication.

POST http://10.0.0.20:8000/v1/chat/completions
Content-Type: application/json
Authorization: Bearer <secret>

{
  "model": "installer-recommended-local-model",
  "messages": [
    { "role": "system", "content": "Classify the ticket. Reply with JSON only." },
    { "role": "user", "content": "{{ $json.body }}" }
  ],
  "temperature": 0
}

Replace the model string with the exact served identifier from /v1/models. If you use NVIDIA NemoClaw’s local vLLM path, use the identifier it records from the running server or its selected managed profile. Managed vLLM is a supported-host option, not a universal property of every NemoClaw install; generic Linux requires an explicit experimental/provider selection. Do not invent a checkpoint name from memory.

HTTP Request is also the right escape hatch when a vendor-specific AI node does not document a custom endpoint.

Authentication and network controls that actually hold

Local does not mean unauthenticated.

For vLLM, --api-key is not a security perimeter for the entire HTTP service. The official security page documents protected and unprotected endpoint sets and recommends network isolation plus a reverse proxy when exposure is necessary (vLLM security guidance). An API key on inference routes does not prove that every route rejects unauthenticated traffic.

Required baseline: bind vLLM only to loopback, a container/cluster network, or a private interface protected by firewall policy that permits only the proxy or n8n workload. Put Caddy, nginx, Traefik, or an equivalent controlled gateway in front when more than one host must connect. Terminate TLS where the path is not already a trusted encrypted overlay, authenticate every route you expose, rate-limit, cap request sizes, and allowlist only required paths. n8n talks to the proxy; clients do not reach vLLM directly.

Use vLLM’s --api-key as an additional control for supported inference endpoints, not as a replacement for the proxy/firewall. Store all credentials in n8n credentials or an approved secret store, not in plain workflow fields that export into Git.

Do not:

• Bind 0.0.0.0 on a home or office WAN IP “temporarily.”
• Share a tunnel URL in Slack.
• Reuse a personal OpenAI key as the “password” for a local server that never checks it. If the server ignores Authorization, the key is theatre.

Prompts sent to a local endpoint still leave the n8n host and may be logged by the inference server, the proxy, and n8n execution history. Local hosting reduces third-party cloud retention; it does not remove logging, screenshots, or operator access. Classify customer text as potentially sensitive or personal data under your policy and applicable law, then verify retention and access controls.

For broader integration hygiene, including scoped credentials, service accounts, and audit trails, use the patterns in connecting AI safely.

Timeouts and slow inference

Local-model latency varies sharply with model, prompt length, hardware, concurrency, and cold-start state. An n8n node’s effective timeout also depends on the node and installed version. For the HTTP Request node, the documented timeout covers waiting for response headers or the beginning of the response body; it is not proof that a streamed or long-running generation is bounded end to end. A default copied from a tutorial can therefore fail a healthy job or leave another layer without a clear limit.

Set timeouts deliberately:

1. Measure a cold and warm call with curl from the n8n host.
2. Set the node’s initial-response timeout above the measured p95, with justified headroom for load spikes.
3. Align workflow, proxy, client, and inference-server limits with the full generation budget.
4. Prefer shorter prompts and smaller max_tokens for classification or routing; reserve long generations for draft steps that can continue asynchronously.

If a step routinely exceeds a few minutes, that step may belong in a queue with async continuation, not a synchronous webhook response.

Smoke-test from the n8n process network namespace, not only from your laptop. Dockerised n8n cannot reach localhost on the host unless you publish the model port into that network. Use the Docker service name, host gateway IP, or a LAN address the container can route to.

Base URL hygiene checklist

Before you mark the credential production-ready:

Failure mode for a down endpoint should be explicit: retry with backoff, route to a human queue, or fail the run loudly. Do not silently fall back to a public API with a different privacy posture unless that fallback is a documented, approved path.

Never expose without a gate

The rule is simple: do not expose vLLM directly to an untrusted network. Its API key does not protect the whole HTTP service. Use network isolation and expose only required paths through an authenticated, rate-limited gateway.

Acceptable patterns:

• Loopback or Docker network only, n8n on the same host or overlay.
• LAN + firewall allowlist for the proxy or n8n workload identity/IP; verify rules from a denied host.
• VPN or Tailscale/ZeroTier mesh; no WAN listeners.
• Reverse proxy with strong auth, TLS, and rate limits if you must serve multiple trusted clients.

Unacceptable patterns:

• Unauthenticated WAN bind.
• “Auth later” demos on a real dataset.
• Sharing the same unauthenticated endpoint with every laptop on guest Wi-Fi.

If you are building toward a private stack with local inference, n8n orchestration, and an agent step, keep the model base URL as an internal contract. Hermes and other runtimes can point at the same private service. When n8n invokes Hermes, choose the authenticated API server if n8n needs the result, or the HMAC webhook adapter for event ingress and configured Hermes delivery. That split is covered in n8n → Hermes: API call or event webhook.

A minimal private support path

Illustrative flow you can implement without inventing performance numbers:

1. Ticket webhook hits n8n.
2. Validate and redact fields.
3. HTTP Request calls the private /v1/chat/completions endpoint for classification JSON.
4. Switch node routes by label.
5. Drafts that leave the company boundary wait for a human gate (idempotency and human gates).

That is enough to prove the local endpoint earns its place before you add richer agents.

What to verify on edit day

Product UIs and credential field names drift. On the day you ship or refresh this workflow:

1. Confirm the live docs for your inference server’s OpenAI-compatible route.
2. Confirm the HTTP Request credential and node configuration still send the required authentication, headers, and raw JSON shape.
3. Re-run curl and one n8n test execution with a non-production payload.
4. Confirm the listener is still private (ss/lsof, firewall rules, no surprise tunnel), an unauthenticated inference request fails, and vLLM’s documented unprotected endpoints are not reachable across the external boundary.

Local OpenAI-compatible endpoints let n8n use private inference without rewriting the automation graph. The work is not clever prompting. It is treating inference like any other internal API: authenticated at the exposed boundary, measured, deliberately logged, and unreachable from strangers.