Configuring credentials safely for n8n automations
What lives in n8n, what never leaves it, and the one place people most often paste secrets by mistake.
Secrets live in n8n — only there
Database passwords, OAuth logins, and API tokens are created under Credentials in your n8n instance and attached to nodes there. RunFlowPilot never asks for them, never stores them, and never transmits them: it only checks whether a required type exists on your instance.
Never paste secrets into the chat
The Copilot chat is sent to the AI to do its work — so it is the worst possible place for a password or private key. Describe what a credential should access (“the Postgres credential with write access to the users table”), never its value. If you pasted one by accident, rotate it immediately in the source system.
Stored n8n connection keys are encrypted and never displayed again — leaving an API-key field empty on edit keeps the stored value.
Least privilege and rotation
Create separate credentials per purpose (reporting read-only versus app read-write), review who can open your n8n instance, and rotate keys after team changes. When a key rotates, use Reverify on the Instances page so deploys keep working.
Next guide
Testing a webhook workflow end to end
Questions? Contact Support.