Can API keys end up exposed in exported n8n workflows?

Yes — if a key is pasted directly into a node's credential field, it can be saved in plain text inside the exported JSON file.

How do I keep API keys safe when sharing n8n workflows?

Use environment variable references like {{ $env.YOUR_KEY_NAME }} inside the workflow, and set the actual value in your n8n instance's environment settings.

Is it safe to share an n8n JSON export publicly?

Only if all credentials are referenced through environment variables rather than hardcoded — otherwise real keys can be visible in the file.

← All Quick Wins

Automation & Workflows

Stop Hardcoding API Keys Into n8n JSON Exports

If you paste a real API key directly into a node's credential field, it can end up baked into the exported workflow JSON in plain text — which becomes a real problem the moment you share that file, commit it, or post it publicly (including as a downloadable template).

The fix:

use environment variable references ({{ $env.YOUR_KEY_NAME }}) inside the workflow instead of the raw key, and set the actual value in your n8n instance's environment settings, not the workflow itself. The exported JSON stays safe to share even with the credential field visible.

Comments

No comments yet — be the first.