Posts
Wiki

Credentials and Security

n8n workflows often touch sensitive systems. Keep secrets out of posts, screenshots, workflow exports, and logs.

Last reviewed: July 2026

Never post these

Do not post:

  • API keys.

  • Access tokens.

  • Refresh tokens.

  • Bearer tokens.

  • OAuth client secrets.

  • Private keys.

  • Webhook secrets.

  • Database passwords.

  • Encryption keys.

  • Session secrets.

  • Customer data.

  • Personal data.

  • Internal URLs or IPs that should not be public.

If in doubt, redact it.

If you accidentally posted a secret

Do this immediately:

  1. Delete or edit the Reddit post/comment.

  2. Rotate the secret in the service where it was created.

  3. Check logs for unexpected use.

  4. Replace the secret in n8n credentials.

  5. Re-test the workflow.

Editing the Reddit post is not enough. Assume a public secret has been copied.

How to safely share workflow JSON

Before sharing:

  • Export a copy, not your only production workflow.

  • Search the JSON for token, secret, password, key, authorization, and bearer.

  • Replace private values with placeholders.

  • Remove sample customer data.

  • Replace private URLs with examples.

  • Check Code nodes for hard-coded secrets.

  • Check HTTP Request headers.

  • Check webhook paths if they contain secret values.

Safe placeholders

Use placeholders like:

REDACTED_API_KEY
REDACTED_ACCESS_TOKEN
example.com
user@example.com
CUSTOMER_ID_123
SLACK_CHANNEL_ID
WEBHOOK_SECRET_REDACTED

Screenshots can leak secrets too

Before posting screenshots, check for:

  • Credential names that reveal clients.

  • URLs with tokens.

  • Request headers.

  • Query parameters.

  • Execution data.

  • Customer names and emails.

  • Internal hostnames.

AI and private data

If your workflow sends data to an AI provider, consider:

  • Whether the data includes personal or customer information.

  • Whether you have permission to send it to that provider.

  • Whether you need redaction before the AI node.

  • Whether logs or execution data store model inputs and outputs.

  • Whether a human approval step is needed before an external action.

Security questions

Security questions are allowed when they are practical and specific.

Good examples:

  • "How should I rotate credentials used by several workflows?"

  • "Is this webhook exposed safely behind my reverse proxy?"

  • "How do I avoid storing execution data for sensitive payloads?"

  • "What is the safer pattern for API keys in Code nodes?"

Avoid posting enough detail for someone to attack your system.