n8n 05 — Credentials & Security

Credentials in n8n are stored encrypted at rest using AES-256 encryption, keyed by N8N_ENCRYPTION_KEY. They are reusable across all workflows and shared across team members (based on access level).

• Access via Settings → Credentials in the n8n sidebar
• Each credential has a name, type, and the secret values
• Workflow nodes reference credentials by name — the actual secret is never embedded in the workflow JSON
• Deleting a credential breaks any node that uses it

# Creating an API Key credential:
1. Settings → Credentials → New Credential
2. Search for "Header Auth" or the specific service (e.g. "OpenAI")
3. Fill in:
   Name:  My OpenAI Key           (your label)
   Value: sk-proj-abc123...       (the actual API key)
4. Save

# In a node, select this credential from the dropdown
# The key is injected automatically — never visible in workflow JSON

# Example: Google OAuth2 setup
1. Go to Google Cloud Console → Create OAuth2 App
   - Client ID:     xxxxxxxxx.apps.googleusercontent.com
   - Client Secret: GOCSPX-xxxxxx

2. In n8n Credentials → New → "Google OAuth2 API"
   Client ID:     (paste from GCP)
   Client Secret: (paste from GCP)
   Callback URL:  https://your-n8n.com/rest/oauth2-credential/callback

3. Add the callback URL to the allowed redirect URIs in GCP

4. Click "Sign in with Google" in n8n → browser opens → grant access
5. Token is stored automatically, refreshed by n8n when it expires

# Scopes needed (set in GCP OAuth consent screen):
https://www.googleapis.com/auth/spreadsheets
https://www.googleapis.com/auth/gmail.send

# .env file for Docker Compose
N8N_ENCRYPTION_KEY=my-super-secret-32char-key-here!
N8N_HOST=n8n.mycompany.com
N8N_PROTOCOL=https
N8N_BASIC_AUTH_ACTIVE=true
N8N_BASIC_AUTH_USER=admin
N8N_BASIC_AUTH_PASSWORD=S3cur3P@ssw0rd

n8n User Roles

API Access

# n8n has a public REST API for managing workflows programmatically
# Enable in Settings → n8n API
# Generate an API key and use it as:
X-N8N-API-KEY: your-api-key

GET https://your-n8n.com/api/v1/workflows
POST https://your-n8n.com/api/v1/workflows/{id}/activate

Header Validation

# In Webhook node → Authentication → Header Auth
Header Name:  X-Webhook-Secret
Header Value: my-shared-secret-123

# Sending services must include:
curl -H "X-Webhook-Secret: my-shared-secret-123" ...

Signature Verification (Code Node)

// Verify HMAC-SHA256 signature (GitHub/Stripe style)
const crypto = require('crypto');
const secret = 'my-webhook-secret';
const body = JSON.stringify($json.body);
const signature = $json.headers['x-hub-signature-256'];

const expected = 'sha256=' + crypto
  .createHmac('sha256', secret)
  .update(body)
  .digest('hex');

if (signature !== expected) {
  throw new Error('Invalid webhook signature');
}
return $input.all();

• Never hardcode API keys in Set nodes or Code nodes — always use Credentials
• Never log sensitive fields (use Code node to delete them before logging)
• Use separate credentials for dev and production environments
• Rotate API keys periodically and update the n8n credential
• Set N8N_ENCRYPTION_KEY before first run — changing it later breaks all credentials
• Back up your .n8n folder (or Postgres DB) — this contains encrypted credentials

• HTTPS Put n8n behind a reverse proxy (Nginx/Caddy) with SSL
• Auth Enable Basic Auth or use n8n's built-in user accounts
• Firewall Block port 5678 from the internet; expose only via reverse proxy
• Updates Keep n8n updated — check GitHub releases regularly
• Backups Automate daily backups of the n8n database
• Logs Monitor execution logs for failed runs and unexpected activity
• IP Restrict If possible, restrict webhook endpoints to known IP ranges
• Least Privilege OAuth scopes should be minimum required for the integration