Resolving "Cannot GET /signin" in n8n - A Practical Guide for CIOs and DevOps

When users encounter "Cannot GET /signin" after clicking Sign In, the issue typically lies in HTTP routing: reverse proxies or load balancers are not forwarding requests to n8n's auth endpoints correctly, or n8n's public base URL and path prefixes are misconfigured. In containerized or behind-proxy deployments, missing or incorrect proxy headers (X-Forwarded-For, X-Forwarded-Proto) and path rewrites often break routing to /signin. Another common cause is using a path prefix in the proxy without matching n8n configuration.

For businesses, login outages are high impact because they block all automation management and can halt operations. Immediate remediation steps: examine your proxy (NGINX, Traefik) rules to ensure requests to /signin are forwarded to the n8n service without being intercepted or rewritten incorrectly. Confirm that N8N_PUBLIC_URL (or the platform's equivalent) matches the externally visible URL. If SSO is integrated, verify that callback URLs registered with the IdP exactly match the public URL used by n8n.

Operational best practices: keep a documented network path diagram and test auth flows in staging before changes. Implement health checks and synthetic monitoring that exercises login endpoints, not just root availability. Maintain an emergency admin access path (e.g., a direct internal route) that bypasses external proxies for troubleshooting.

Leaders should ensure authentication and networking configurations are included in change-management approvals. For larger teams, prioritize redundant admin access and clear escalation to platform vendors or in-house networking teams. Finally, include login verification in deployment pipelines so configuration drift is detected before it affects users.