Use Credential Sharing Instead of Duplicating API Keys

When multiple workflows need the same API key, developers often create separate credentials for each workflow or hardcode keys in Code nodes. This makes key rotation a nightmare and increases the attack surface.

Real-world example: A team has 30 workflows using the Slack API. Each workflow has its own copy of the Slack bot token. When the token is rotated, someone must update 30 credentials -- and inevitably misses two, causing silent failures.

The correct approach is to create one credential and share it:

1. Go to Credentials > Create New Credential
2. Select the credential type (e.g., Slack API)
3. Enter the API key/token once
4. Click the "Sharing" tab
5. Share with specific users or all workspace members
6. All workflows reference this single credential
```text
When the API key is rotated:

```text
1. Go to Credentials
2. Edit the single Slack API credential
3. Update the token
4. Save -- all 30 workflows immediately use the new token
```text
| Approach | Key Rotation Effort | Risk of Stale Keys | Audit Trail |
|:---------|:-------------------|:-------------------|:------------|
| Duplicate credentials per workflow | O(n) -- update every copy | High | Poor -- hard to find all copies |
| Shared credential | O(1) -- update once | None | Good -- one place to check |
| Hardcoded in Code nodes | O(n) -- find and edit code | Very high | None |

> **Warning: Credential Scope**
>
> Shared credentials are accessible to anyone with the sharing permission. Limit sharing to users who need it, and use n8n's role-based access control to restrict who can create or modify credentials.

**Related:** [Use Docker Compose with Health Checks for n8n and PostgreSQL](../self-hosting-operations/01-use-docker-compose-with-health-checks-for-n8n-and-postgresql.md) | [Use Path Parameters in Webhook URLs for Dynamic Routing](../webhook-mastery/01-use-path-parameters-in-webhook-urls-for-dynamic-routing.md)