n8n-credentials-and-security

What problem does it solve?

It prevents credentials and tokens from being accidentally exposed in workflow fields, SDK code, exports, screenshots, or chat history by guiding the correct way to use n8n’s credential system for all auth-related needs.

Core Features & Use Cases

• Credential-first security rules: keeps API keys, bearer tokens, OAuth secrets, passwords, and authorization headers out of plain text fields and expressions.
• Correct credential selection and validation: explains how n8n auto-assigns the most recently edited credential of a given type and why you must verify each node’s dropdown selection.
• Auth decision guidance: routes users to the right credential type based on service auth shape (native credentials, OAuth2, bearer/basic/header auth, or httpCustomAuth for multi-header/header+query patterns).
• References for implementation details: provides supporting docs for the credential storage model, custom auth credential design, and HTTP Request auth wiring.

Quick Start

Tell the AI to configure your workflow to use the proper n8n credential type for the auth scheme you’re implementing, and then open every node that references a credential to confirm the correct one is selected in the dropdown.