Managing n8n Credentials and Environment Variables Safely (Best Practices)
Every n8n workflow is only as secure as the credentials behind it. A single leaked API key can drain an OpenAI budget, expose a CRM, or let someone send email as your company. Yet credential hygiene is the part of automation almost everyone skips until an incident forces the lesson.
This guide covers how n8n stores secrets, how to use environment variables the right way, and the least-privilege habits that keep a breach small if one ever happens.
How n8n stores credentials
n8n encrypts stored credentials using an N8N_ENCRYPTION_KEY. On self-hosted instances this key lives in your environment — if you lose it, every saved credential becomes unreadable; if someone steals it plus your database, they can decrypt everything. Rule one: back up the encryption key somewhere separate from the database, and never commit it to git.
Use environment variables, not hard-coded keys
Never paste an API key directly into an HTTP Request node's URL or headers where it gets saved in the workflow JSON. Instead, store secrets as environment variables and reference them with $env, or use n8n's native Credentials so the value is encrypted and masked in the UI. Workflow JSON gets exported, shared, and backed up — you do not want live secrets riding along.
Apply least privilege to every key
When you create an API key for a workflow, scope it to exactly what the workflow needs. A workflow that reads Shopify orders should use a key with read-only order access, not full admin. If that key leaks, the blast radius is tiny. The same goes for database users, service accounts, and OAuth scopes.
⚡ Skip the build — grab the ready-made template
For workflows where data can never leave your server, this fully offline template runs entirely on your own hardware with Ollama — no third-party API keys at all.
Get "100% Private Offline AI Chatbot (Ollama)" on Gumroad — $79 →
Rotate and audit
Set a calendar reminder to rotate high-value keys quarterly, and immediately after any team member leaves. Keep a simple registry — which key powers which workflow, created when, scoped to what — so rotation isn't a guessing game. n8n's execution logs also help you spot a credential being used in a workflow it shouldn't be.
When the safest key is no key at all
For sensitive data — legal documents, health records, internal financials — the most secure architecture removes third-party APIs entirely. Running a local LLM with Ollama inside your own n8n instance means the data never leaves your network and there's no external key to leak. It's the difference between trusting a vendor's security and owning it yourself.
Frequently asked questions
Where should N8N_ENCRYPTION_KEY live?
In your environment/secrets manager, backed up separately from the database, and never in version control. Losing it makes every stored credential unrecoverable.
Is n8n Cloud or self-hosted more secure?
Both can be secure. Cloud offloads infrastructure hardening to n8n; self-hosted gives you full control (and full responsibility). For maximum data isolation, self-hosted with local models keeps everything in-house.
Ready to automate this?
You can wire this together yourself with the steps above, or install a battle-tested version in minutes. The 100% Private Offline AI Chatbot (Ollama) template ships with the full n8n workflow JSON, setup notes, and sample credentials so you can import, plug in your keys, and go live today.
