# Connect your apps with credentials

> Create, name, test and share n8n credentials safely, for API keys, OAuth sign-ins and email accounts.

Source: https://viralistic.nl/help/n8n/credentials

Before n8n can read your inbox or post to Slack, it needs permission. That permission lives in a credential: a saved login, API key or OAuth connection that nodes reuse. This article shows how to create credentials, the three types you will meet, and how to keep them safe.

## How credentials work

You create a credential once, give it a clear name, and pick it in any node that talks to that app. n8n stores credentials encrypted in its database. People who use a workflow do not see the secret itself, only the credential name.

If the password or key changes, you update the credential in one place and every workflow that uses it keeps working.

## Create a credential

There are two ways to start:

### From a node (easiest)

1. Open the node, for example Gmail or Google Sheets.
2. In the **Credential to connect with** dropdown, choose to create a new credential.
3. Fill in the fields or sign in (see the types below).
4. Save. n8n tests the credential and shows whether it works.

### From the overview

1. Select the create button (the plus) in the side menu and choose Credential.
2. If your instance uses projects, choose the project the credential belongs to.
3. Search for the app, fill in the details and save.

## The three types you will meet

| Type                  | What you enter                            | Typical apps                                 |
| --------------------- | ----------------------------------------- | -------------------------------------------- |
| API key or token      | A key you copy from the app's settings    | OpenAI, Anthropic, Airtable, many SaaS tools |
| OAuth2                | You click a button and sign in to the app | Google, Microsoft, Slack, HubSpot            |
| Username and password | Server, port, user and password           | IMAP and SMTP email, databases, FTP          |

### API keys

Create the key in the other app, usually under Settings, Developer or API. Give it the smallest permissions that still work, and paste it into n8n. Many apps show the key only once, so paste it straight away.

### OAuth2

On n8n Cloud, many popular apps offer a one-click sign-in from the credential screen. On a self-hosted instance you often need to create your own OAuth app with the provider first (for example in Google Cloud Console), then paste its client ID and client secret into n8n. The credential screen shows the **OAuth Redirect URL** that you must register with the provider.

> **Note:** For Google, make sure the right APIs are enabled in your Google Cloud project (such as the Gmail API or Google Sheets API). A missing API is the most common reason a Google credential connects but the node still fails.

### Email accounts

For IMAP and SMTP you enter the server, port, username and password. Many providers require an app password instead of your normal password. See [Process incoming email with the IMAP trigger](https://viralistic.nl/help/n8n/imap-trigger).

## Name credentials so you can find them

n8n names a new credential "app name account" by default. Rename it right away. A good pattern is app, account and purpose:

```text
Gmail / info@yourcompany.com / support inbox
Slack / Viralistic workspace / alerts bot
```

Clear names prevent the classic mistake of sending customer emails from a personal account.

## Share credentials with your team

Depending on your plan, you can share a credential with colleagues or keep it inside a shared project. Teammates can then use it in their workflows without ever seeing the password or key. This is safer than sending keys over chat. See [Share logins and access safely](https://viralistic.nl/help/account/share-access-safely) for the general rules we follow.

## Keep credentials safe

1. Use a dedicated account or bot user for automations where possible, not your personal login.
2. Give each key the minimum scope it needs.
3. On credentials for web APIs, use **Allowed HTTP Request Domains** to limit which domains the credential may be sent to from an HTTP Request node.
4. Never paste keys into a Code node, a sticky note or a chat with an AI assistant. Always use a credential.
5. Rotate keys when someone leaves the team, and delete credentials you no longer use.

> **Warning:** On a self-hosted instance, credentials are encrypted with a key stored in the n8n data folder (or in the `N8N_ENCRYPTION_KEY` variable). If you lose that key, you lose every credential. Include it in your backups, see [Update and back up a self-hosted n8n](https://viralistic.nl/help/n8n/self-hosting-maintenance).

## When a credential stops working

- **Expired OAuth connection:** open the credential and reconnect.
- **Changed password or revoked key:** update the value and save to retest.
- **Permission errors:** the account works but lacks access to that file, channel or mailbox. Fix it in the app, not in n8n.

## Next steps

- [Build your first workflow](https://viralistic.nl/help/n8n/first-workflow)
- [Process incoming email with the IMAP trigger](https://viralistic.nl/help/n8n/imap-trigger)
- [Error handling and alerts](https://viralistic.nl/help/n8n/error-handling)