Use Credential Sharing Instead of Duplicating API Keys

When multiple workflows need the same API key, developers often create a separate credential for each workflow or hardcode the key in Code nodes. This makes key rotation a nightmare and widens the attack surface. The fix is to create one credential and share it, so every workflow references a single copy you can rotate in one place.

Real-world example: A team has 30 workflows using the Slack API. Each workflow has its own copy of the Slack bot token. When the token is rotated, someone must update 30 credentials -- and inevitably misses two, causing silent failures.

How do you share a credential across workflows?

The correct approach is to create one credential and share it:

1. Go to Credentials > Create New Credential
2. Select the credential type (e.g., Slack API)
3. Enter the API key/token once
4. Click the "Sharing" tab
5. Share with specific users or all workspace members
6. All workflows reference this single credential

How does rotating a shared key work?

When the API key is rotated:

1. Go to Credentials
2. Edit the single Slack API credential
3. Update the token
4. Save -- all 30 workflows immediately use the new token

What's the difference between shared and duplicated credentials?

Approach	Key Rotation Effort	Risk of Stale Keys	Audit Trail
Duplicate credentials per workflow	O(n) -- update every copy	High	Poor -- hard to find all copies
Shared credential	O(1) -- update once	None	Good -- one place to check
Hardcoded in Code nodes	O(n) -- find and edit code	Very high	None

Warning: Credential Scope

Shared credentials are accessible to anyone with the sharing permission. Limit sharing to users who need it, and use n8n's role-based access control to restrict who can create or modify credentials.

Related: Use Docker Compose with Health Checks for n8n and PostgreSQL · Use Path Parameters in Webhook URLs for Dynamic Routing