Credentials and Authentication

Credentials in n8n store the authentication details -- API keys, tokens, and OAuth2 grants -- that nodes use to reach external services. They are encrypted at rest and kept separate from workflows, so updating one credential applies everywhere it is referenced. n8n supports API key, OAuth2, basic, header, digest, query, and session authentication, and credentials can be shared with other users without exposing the stored secrets.

What are credentials in n8n, and how do you create them?

Credentials in n8n store authentication details (API keys, tokens, OAuth2 grants) that nodes use to connect to external services. They are encrypted at rest and decoupled from workflows, so updating a credential automatically applies to every workflow that references it.

1. Open the Credentials section from the left sidebar, or click Create New when a node prompts for a credential.
2. Select the credential type (matches the service, e.g., "Slack OAuth2 API").
3. Fill in the required fields.
4. Click Save. n8n validates the credential against the service if a test endpoint is available.

Tip: Name credentials descriptively (e.g., "Production Slack Bot" vs "Slack") to avoid confusion when multiple credentials exist for the same service.

What authentication types does n8n support?

API Key

The simplest method. Paste an API key or token from the third-party service into the credential form. n8n sends it in the header, query string, or body as the service requires.

OAuth2

n8n handles the full OAuth2 authorization code flow:

1. Register an OAuth app with the external service and obtain a Client ID and Client Secret.
2. Enter these in the n8n credential form along with the required scopes.
3. Click Connect -- n8n redirects to the service's consent screen.
4. After authorization, n8n stores the access and refresh tokens and handles automatic token refresh.

Note: The OAuth2 callback URL must be registered in the external service's app settings. n8n displays the correct callback URL in the credential form.

Other Supported Types

Type	Examples
Basic Auth	Username and password sent as an HTTP Basic header
Header Auth	Custom header name and value
Digest Auth	Challenge-response authentication
Query Auth	Credentials sent as URL query parameters
Session-based	Cookie-based login flow (less common)

How do you share credentials safely?

Credentials can be shared with other users on the same n8n instance:

• Owner -- full control, can edit and delete.
• Shared users -- can use the credential in their workflows but cannot view the stored secret values.

Warning: Shared credentials expose access to the underlying service. Only share with users who should have that level of access.

What security practices apply to credentials?

• Credentials are encrypted with an instance-level encryption key (N8N_ENCRYPTION_KEY). Back up this key -- without it, saved credentials cannot be decrypted.
• Never hard-code secrets in expressions or Code nodes. Always use the credential system.
• Rotate secrets periodically and re-test credentials after rotation.
• On self-hosted instances, restrict access to the n8n database, as encrypted credentials are stored there.

Related: Environment Variables · Webhooks