Credentials and Authentication

What Are Credentials

Credentials in n8n store authentication details (API keys, tokens, OAuth2 grants) that nodes use to connect to external services. They are encrypted at rest and decoupled from workflows, so updating a credential automatically applies to every workflow that references it.

Creating Credentials

1. Open the Credentials section from the left sidebar, or click Create New when a node prompts for a credential.
2. Select the credential type (matches the service, e.g., "Slack OAuth2 API").
3. Fill in the required fields.
4. Click Save. n8n validates the credential against the service if a test endpoint is available.

Tip

Name credentials descriptively (e.g., "Production Slack Bot" vs "Slack") to avoid confusion when multiple credentials exist for the same service.

Authentication Types

API Key

The simplest method. Paste an API key or token from the third-party service into the credential form. n8n sends it in the header, query string, or body as the service requires.

OAuth2

n8n handles the full OAuth2 authorization code flow:

1. Register an OAuth app with the external service and obtain a Client ID and Client Secret.
2. Enter these in the n8n credential form along with the required scopes.
3. Click Connect -- n8n redirects to the service's consent screen.
4. After authorization, n8n stores the access and refresh tokens and handles automatic token refresh.

Note

The OAuth2 callback URL must be registered in the external service's app settings. n8n displays the correct callback URL in the credential form.

Other Supported Types

Type	Examples
Basic Auth	Username and password sent as an HTTP Basic header
Header Auth	Custom header name and value
Digest Auth	Challenge-response authentication
Query Auth	Credentials sent as URL query parameters
Session-based	Cookie-based login flow (less common)

Credential Sharing

Credentials can be shared with other users on the same n8n instance:

• Owner -- full control, can edit and delete.
• Shared users -- can use the credential in their workflows but cannot view the stored secret values.

Warning

Shared credentials expose access to the underlying service. Only share with users who should have that level of access.

Security Considerations

• Credentials are encrypted with an instance-level encryption key (N8N_ENCRYPTION_KEY). Back up this key -- without it, saved credentials cannot be decrypted.
• Never hard-code secrets in expressions or Code nodes. Always use the credential system.
• Rotate secrets periodically and re-test credentials after rotation.
• On self-hosted instances, restrict access to the n8n database, as encrypted credentials are stored there.

Related tips: Security Best Practices, Integration Patterns

See Also

• Security Best Practices
• Environment Variables
• Webhooks