Question 1

How does n8n store credentials and what does that mean for security?

Accepted Answer

Explain the mechanism, then draw the practical consequence — the second half is what makes the answer strong. "Credentials are stored as separate objects rather than inside nodes, and written to the database encrypted. The encryption key is generated the first time the instance starts and kept in its configuration. On top of that, only node types with the right access can read credential data. Two practical consequences follow. First, a backup is not just the database — you need the key too, or credentials will not decrypt after a restore. Second, the key itself is the most sensitive secret; manage it as an environment variable rather than leaving it as a plain file on the server."

Question 2

How would you connect n8n to an internal API that has no dedicated node?

Accepted Answer

The answer is the HTTP Request node, but the credential part is what matters. "I use the HTTP Request node. I do not type the key into a node parameter — I pick Generic Credential Type and create a credential of whatever kind the API expects: Header Auth, Bearer, Basic or Query Auth. The reason is practical: node parameters are part of the workflow JSON, so exporting, sharing or sending it to support carries the key along. A credential stays encrypted and its value is not included in an export. For internal APIs I also always look at timeout and retry settings, because internal services are often less stable than public ones."

Question 3

Explain the difference between OAuth2 and an API key.

Accepted Answer

Frame it around "on whose behalf" — that is the clearest framing. "An API key is a static secret: you send it with the request and the service recognises it. Simple, but it does not expire, it is not obvious whose behalf it acts on, and if it leaks it must be revoked immediately. With OAuth2 the user grants n8n access on the service's own page. n8n never sees the password — it receives a short-lived access token and refreshes it itself with a refresh token. Permissions are scoped precisely and the user can revoke access at any time. That is why Google, Slack and Microsoft require OAuth2: there the question is authorised access to a specific user's data, not merely identifying the service."

Authentication type	How it works	Where you meet it
API Key	A static key sent as a header or query parameter	Simple services, internal APIs
Bearer token	An `Authorization: Bearer <token>` header	Most modern REST APIs
Basic auth	Username and password encoded with base64	Legacy systems, internal services
OAuth2	You grant access on the service's own page; n8n receives a token and refreshes it itself	Google, Slack, Microsoft, GitHub
Header auth	A header name and value of your choice — for non-standard APIs	Custom or internal integrations

Credentials and authentication

📚 Sources and documentation