[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-n8n-n8n-credentials-and-security-official":3,"mdc--axory2-key":36,"related-repo-n8n-n8n-credentials-and-security-official":794,"related-org-n8n-n8n-credentials-and-security-official":891},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":32,"sourceUrl":34,"mdContent":35},"n8n-credentials-and-security-official","manage credentials and security in n8n","Use when handling any auth, API keys, tokens, OAuth, bearer tokens, basic auth, or secret values in n8n workflows. Triggers on \"API key\", \"token\", \"bearer\", \"OAuth\", \"secret\", \"auth\", \"credentials\", \"Authorization header\", \"x-api-key\", or any node configuration that mentions a third-party service.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},"n8n","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fn8n.png","n8n-io",[12,16,17,20,23],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":8,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"Automation","automation",{"name":21,"slug":22,"type":15},"Authentication","authentication",{"name":24,"slug":25,"type":15},"OAuth","oauth",319,"https:\u002F\u002Fgithub.com\u002Fn8n-io\u002Fskills","2026-07-08T05:45:07.766252",null,30,[],{"repoUrl":27,"stars":26,"forks":30,"topics":33,"description":29},[],"https:\u002F\u002Fgithub.com\u002Fn8n-io\u002Fskills\u002Ftree\u002FHEAD\u002Fskills\u002Fn8n-credentials-and-security-official","---\nname: n8n-credentials-and-security-official\ndescription: Use when handling any auth, API keys, tokens, OAuth, bearer tokens, basic auth, or secret values in n8n workflows. Triggers on \"API key\", \"token\", \"bearer\", \"OAuth\", \"secret\", \"auth\", \"credentials\", \"Authorization header\", \"x-api-key\", or any node configuration that mentions a third-party service.\n---\n\n# n8n Credentials and Security\n\n## Non-negotiables\n\n1. **Secrets via the credential system, never in text fields or SDK code.** API keys, bearer tokens, OAuth secrets, passwords: all go through `newCredential()` or the node's `credentials` parameter. A Set node hardcoding a token and read via `{{$json.token}}` is a text field with extra steps.\n2. **List credentials, then bind by ID.** Call `list_credentials({type})` before configuring an auth-needing node. One match: bind via 2-arg `newCredential('Label', 'credId')` at create time, or `setNodeCredential` op on `update_workflow`. Multiple matches: ask the user which. The one-arg `newCredential('Label')` is a placeholder; n8n auto-assigns the most recently edited credential of that type and silently picks wrong when the user has multiples.\n3. **Credential creation is the user's job, not yours.** The n8n MCP doesn't expose credential creation. Tell the user the exact credential *type* to create in the UI, then reference it by label in your node config. Don't attempt to create credentials programmatically and don't accept secrets in chat to \"set up later\".\n\n## Strong defaults\n\n- **Use native credentials when available.** Every native node (Slack, Gmail, Postgres, OpenAI, etc.) has a credential type. Don't reach for generic credential types when a native option exists.\n- **For multi-header or header-plus-query auth shapes**, use the `httpCustomAuth` credential type. See `references\u002FCUSTOM_CREDENTIALS.md`.\n\n## The credential system\n\nIn n8n, credentials are first-class objects:\n\n- Stored encrypted at rest in the n8n database.\n- Referenced by ID from nodes that need them.\n- Scoped to projects (Cloud & enterprise) or shared globally (some self-hosted setups).\n- Identified by a type slug (googleSheetsOAuth2Api, slackApi, httpHeaderAuth). The slug is what nodes reference and what determines which auth fields the credential collects.\n\nA node that needs auth has a `credentials` parameter pointing to a credential ID + type. Secret values never appear in workflow JSON. Exporting a workflow leaks the *reference*, not the secret.\n\nFor the full model (SDK resolution, rotation, project scoping), see `references\u002FCREDENTIAL_SYSTEM.md`.\n\n## Decision tree: how to authenticate this thing\n\n```\nNeed to call an external service?\n├── Native credential exists (Slack, Gmail, OpenAI, Postgres, ...)?\n│   └── Use the native node + its credential type. Done.\n│\n├── Service is \"standard-shaped\" (REST + Bearer\u002FBasic\u002FOAuth)?\n│   ├── Configure HTTP Request with one of the built-in auth types:\n│   │   - Generic OAuth2\n│   │   - Header Auth\n|   |   - Bearer Auth (same as header auth but with only field being for actual token)\n│   │   - Basic Auth\n│   │   - Custom Auth\n│   └── See references\u002FHTTP_REQUEST_WITH_AUTH.md\n│\n└── Service needs multiple static headers, or headers plus query params?\n    └── Use the httpCustomAuth credential type.\n        See references\u002FCUSTOM_CREDENTIALS.md\n```\n\n## When the user pastes a secret into a chat\n\nThis happens. The user types something like:\n\n> \"Set up a workflow to call Acme API with bearer `sk-abc123def456`\"\n\nWhat to do:\n\n1. **Don't put the token in a text field, even temporarily.** A Set node that hardcodes the value and is referenced via `{{$json.token}}` is a text field with extra steps.\n2. **Bind to an existing credential if possible.** `list_credentials({type})` first; if a match exists, bind via `setNodeCredential` and tell the user which one you used. If none exists, tell them to create one in the UI (Bearer Auth for bearer tokens, Header Auth for custom headers, etc.). Credential creation is still UI-only.\n3. **Treat the pasted secret as compromised, and tell the user to rotate it.** Don't soften this. The token has been transmitted to the LLM provider, may persist in chat history, transcripts, and cache layers. Tell them: \"Rotate this token as soon as the new credential is set up. Treat it as leaked.\"\n\n## When no native node exists\n\nCommon case: the user wants a service n8n has no node for. Use HTTP Request with appropriate auth.\n\n- `references\u002FFINDING_API_DOCS.md`: discovering auth scheme, base URL, common shapes.\n- `references\u002FHTTP_REQUEST_WITH_AUTH.md`: wiring HTTP Request to a credential.\n- `references\u002FCUSTOM_CREDENTIALS.md`: when built-in auth types don't fit.\n\n## Reference files\n\n| File | Read when |\n|---|---|\n| `references\u002FCREDENTIAL_SYSTEM.md` | You need to understand how credentials are stored, referenced, scoped, or rotated |\n| `references\u002FCUSTOM_CREDENTIALS.md` | Multi-header \u002F header-plus-query auth in one credential, or per-request signing patterns (HMAC, JWT, webhook validation) |\n| `references\u002FHTTP_REQUEST_WITH_AUTH.md` | Configuring HTTP Request with auth: Bearer, Basic, OAuth, Header Auth |\n| `references\u002FFINDING_API_DOCS.md` | The user mentioned a service you don't have node-level knowledge of |\n\n## Anti-patterns\n\n| Anti-pattern | What goes wrong | Fix |\n|---|---|---|\n| Pasting `sk-...` into HTTP Request's `Authorization` header value field | Token in plain text in the workflow JSON, leaks on export, copy, screenshot | Use a credential: `Bearer Auth` for bearer tokens, `Header Auth` for other custom auth schemes |\n| Storing token in a Set node and referencing via expression | Same problem, value lives in workflow JSON | Same fix: credential, not a Set node |\n| Storing a secret in `$vars.X` and reading it as the auth value | Not encrypted at rest, leaks in exports, no rotation | Use the right credential type (`httpBearerAuth`, `httpHeaderAuth`, `httpCustomAuth`, or the native one). For inbound webhook auth, use the trigger's `authentication` field, not an IF on `$vars.token` |\n| Reaching for `$env.X` to read a secret during custom auth setup | Doesn't work, throws at runtime | Use a credential of the appropriate type |\n| Using HTTP Request when a native node exists | Loses auto-refresh on OAuth, loses native error handling, more code | Use the native node |\n| Hardcoding credentials in SDK code (`new HttpRequest({ headers: { Authorization: 'Bearer xxx' } })`) | Same leak surface | Use `newCredential()` in SDK code |\n| Asking the user to create a credential without naming the credential *type* | User picks the wrong type, auth fails confusingly | Always specify: \"create a credential of type `\u003Cexact type name>`\" |\n\n",{"data":37,"body":38},{"name":4,"description":6},{"type":39,"children":40},"root",[41,50,57,166,172,212,218,224,247,266,278,284,296,302,307,324,329,382,388,393,428,434,526,532],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"n8n-credentials-and-security",[47],{"type":48,"value":49},"text","n8n Credentials and Security",{"type":42,"tag":51,"props":52,"children":54},"h2",{"id":53},"non-negotiables",[55],{"type":48,"value":56},"Non-negotiables",{"type":42,"tag":58,"props":59,"children":60},"ol",{},[61,98,148],{"type":42,"tag":62,"props":63,"children":64},"li",{},[65,71,73,80,82,88,90,96],{"type":42,"tag":66,"props":67,"children":68},"strong",{},[69],{"type":48,"value":70},"Secrets via the credential system, never in text fields or SDK code.",{"type":48,"value":72}," API keys, bearer tokens, OAuth secrets, passwords: all go through ",{"type":42,"tag":74,"props":75,"children":77},"code",{"className":76},[],[78],{"type":48,"value":79},"newCredential()",{"type":48,"value":81}," or the node's ",{"type":42,"tag":74,"props":83,"children":85},{"className":84},[],[86],{"type":48,"value":87},"credentials",{"type":48,"value":89}," parameter. A Set node hardcoding a token and read via ",{"type":42,"tag":74,"props":91,"children":93},{"className":92},[],[94],{"type":48,"value":95},"{{$json.token}}",{"type":48,"value":97}," is a text field with extra steps.",{"type":42,"tag":62,"props":99,"children":100},{},[101,106,108,114,116,122,124,130,132,138,140,146],{"type":42,"tag":66,"props":102,"children":103},{},[104],{"type":48,"value":105},"List credentials, then bind by ID.",{"type":48,"value":107}," Call ",{"type":42,"tag":74,"props":109,"children":111},{"className":110},[],[112],{"type":48,"value":113},"list_credentials({type})",{"type":48,"value":115}," before configuring an auth-needing node. One match: bind via 2-arg ",{"type":42,"tag":74,"props":117,"children":119},{"className":118},[],[120],{"type":48,"value":121},"newCredential('Label', 'credId')",{"type":48,"value":123}," at create time, or ",{"type":42,"tag":74,"props":125,"children":127},{"className":126},[],[128],{"type":48,"value":129},"setNodeCredential",{"type":48,"value":131}," op on ",{"type":42,"tag":74,"props":133,"children":135},{"className":134},[],[136],{"type":48,"value":137},"update_workflow",{"type":48,"value":139},". Multiple matches: ask the user which. The one-arg ",{"type":42,"tag":74,"props":141,"children":143},{"className":142},[],[144],{"type":48,"value":145},"newCredential('Label')",{"type":48,"value":147}," is a placeholder; n8n auto-assigns the most recently edited credential of that type and silently picks wrong when the user has multiples.",{"type":42,"tag":62,"props":149,"children":150},{},[151,156,158,164],{"type":42,"tag":66,"props":152,"children":153},{},[154],{"type":48,"value":155},"Credential creation is the user's job, not yours.",{"type":48,"value":157}," The n8n MCP doesn't expose credential creation. Tell the user the exact credential ",{"type":42,"tag":159,"props":160,"children":161},"em",{},[162],{"type":48,"value":163},"type",{"type":48,"value":165}," to create in the UI, then reference it by label in your node config. Don't attempt to create credentials programmatically and don't accept secrets in chat to \"set up later\".",{"type":42,"tag":51,"props":167,"children":169},{"id":168},"strong-defaults",[170],{"type":48,"value":171},"Strong defaults",{"type":42,"tag":173,"props":174,"children":175},"ul",{},[176,186],{"type":42,"tag":62,"props":177,"children":178},{},[179,184],{"type":42,"tag":66,"props":180,"children":181},{},[182],{"type":48,"value":183},"Use native credentials when available.",{"type":48,"value":185}," Every native node (Slack, Gmail, Postgres, OpenAI, etc.) has a credential type. Don't reach for generic credential types when a native option exists.",{"type":42,"tag":62,"props":187,"children":188},{},[189,194,196,202,204,210],{"type":42,"tag":66,"props":190,"children":191},{},[192],{"type":48,"value":193},"For multi-header or header-plus-query auth shapes",{"type":48,"value":195},", use the ",{"type":42,"tag":74,"props":197,"children":199},{"className":198},[],[200],{"type":48,"value":201},"httpCustomAuth",{"type":48,"value":203}," credential type. See ",{"type":42,"tag":74,"props":205,"children":207},{"className":206},[],[208],{"type":48,"value":209},"references\u002FCUSTOM_CREDENTIALS.md",{"type":48,"value":211},".",{"type":42,"tag":51,"props":213,"children":215},{"id":214},"the-credential-system",[216],{"type":48,"value":217},"The credential system",{"type":42,"tag":219,"props":220,"children":221},"p",{},[222],{"type":48,"value":223},"In n8n, credentials are first-class objects:",{"type":42,"tag":173,"props":225,"children":226},{},[227,232,237,242],{"type":42,"tag":62,"props":228,"children":229},{},[230],{"type":48,"value":231},"Stored encrypted at rest in the n8n database.",{"type":42,"tag":62,"props":233,"children":234},{},[235],{"type":48,"value":236},"Referenced by ID from nodes that need them.",{"type":42,"tag":62,"props":238,"children":239},{},[240],{"type":48,"value":241},"Scoped to projects (Cloud & enterprise) or shared globally (some self-hosted setups).",{"type":42,"tag":62,"props":243,"children":244},{},[245],{"type":48,"value":246},"Identified by a type slug (googleSheetsOAuth2Api, slackApi, httpHeaderAuth). The slug is what nodes reference and what determines which auth fields the credential collects.",{"type":42,"tag":219,"props":248,"children":249},{},[250,252,257,259,264],{"type":48,"value":251},"A node that needs auth has a ",{"type":42,"tag":74,"props":253,"children":255},{"className":254},[],[256],{"type":48,"value":87},{"type":48,"value":258}," parameter pointing to a credential ID + type. Secret values never appear in workflow JSON. Exporting a workflow leaks the ",{"type":42,"tag":159,"props":260,"children":261},{},[262],{"type":48,"value":263},"reference",{"type":48,"value":265},", not the secret.",{"type":42,"tag":219,"props":267,"children":268},{},[269,271,277],{"type":48,"value":270},"For the full model (SDK resolution, rotation, project scoping), see ",{"type":42,"tag":74,"props":272,"children":274},{"className":273},[],[275],{"type":48,"value":276},"references\u002FCREDENTIAL_SYSTEM.md",{"type":48,"value":211},{"type":42,"tag":51,"props":279,"children":281},{"id":280},"decision-tree-how-to-authenticate-this-thing",[282],{"type":48,"value":283},"Decision tree: how to authenticate this thing",{"type":42,"tag":285,"props":286,"children":290},"pre",{"className":287,"code":289,"language":48},[288],"language-text","Need to call an external service?\n├── Native credential exists (Slack, Gmail, OpenAI, Postgres, ...)?\n│   └── Use the native node + its credential type. Done.\n│\n├── Service is \"standard-shaped\" (REST + Bearer\u002FBasic\u002FOAuth)?\n│   ├── Configure HTTP Request with one of the built-in auth types:\n│   │   - Generic OAuth2\n│   │   - Header Auth\n|   |   - Bearer Auth (same as header auth but with only field being for actual token)\n│   │   - Basic Auth\n│   │   - Custom Auth\n│   └── See references\u002FHTTP_REQUEST_WITH_AUTH.md\n│\n└── Service needs multiple static headers, or headers plus query params?\n    └── Use the httpCustomAuth credential type.\n        See references\u002FCUSTOM_CREDENTIALS.md\n",[291],{"type":42,"tag":74,"props":292,"children":294},{"__ignoreMap":293},"",[295],{"type":48,"value":289},{"type":42,"tag":51,"props":297,"children":299},{"id":298},"when-the-user-pastes-a-secret-into-a-chat",[300],{"type":48,"value":301},"When the user pastes a secret into a chat",{"type":42,"tag":219,"props":303,"children":304},{},[305],{"type":48,"value":306},"This happens. The user types something like:",{"type":42,"tag":308,"props":309,"children":310},"blockquote",{},[311],{"type":42,"tag":219,"props":312,"children":313},{},[314,316,322],{"type":48,"value":315},"\"Set up a workflow to call Acme API with bearer ",{"type":42,"tag":74,"props":317,"children":319},{"className":318},[],[320],{"type":48,"value":321},"sk-abc123def456",{"type":48,"value":323},"\"",{"type":42,"tag":219,"props":325,"children":326},{},[327],{"type":48,"value":328},"What to do:",{"type":42,"tag":58,"props":330,"children":331},{},[332,348,372],{"type":42,"tag":62,"props":333,"children":334},{},[335,340,342,347],{"type":42,"tag":66,"props":336,"children":337},{},[338],{"type":48,"value":339},"Don't put the token in a text field, even temporarily.",{"type":48,"value":341}," A Set node that hardcodes the value and is referenced via ",{"type":42,"tag":74,"props":343,"children":345},{"className":344},[],[346],{"type":48,"value":95},{"type":48,"value":97},{"type":42,"tag":62,"props":349,"children":350},{},[351,356,358,363,365,370],{"type":42,"tag":66,"props":352,"children":353},{},[354],{"type":48,"value":355},"Bind to an existing credential if possible.",{"type":48,"value":357}," ",{"type":42,"tag":74,"props":359,"children":361},{"className":360},[],[362],{"type":48,"value":113},{"type":48,"value":364}," first; if a match exists, bind via ",{"type":42,"tag":74,"props":366,"children":368},{"className":367},[],[369],{"type":48,"value":129},{"type":48,"value":371}," and tell the user which one you used. If none exists, tell them to create one in the UI (Bearer Auth for bearer tokens, Header Auth for custom headers, etc.). Credential creation is still UI-only.",{"type":42,"tag":62,"props":373,"children":374},{},[375,380],{"type":42,"tag":66,"props":376,"children":377},{},[378],{"type":48,"value":379},"Treat the pasted secret as compromised, and tell the user to rotate it.",{"type":48,"value":381}," Don't soften this. The token has been transmitted to the LLM provider, may persist in chat history, transcripts, and cache layers. Tell them: \"Rotate this token as soon as the new credential is set up. Treat it as leaked.\"",{"type":42,"tag":51,"props":383,"children":385},{"id":384},"when-no-native-node-exists",[386],{"type":48,"value":387},"When no native node exists",{"type":42,"tag":219,"props":389,"children":390},{},[391],{"type":48,"value":392},"Common case: the user wants a service n8n has no node for. Use HTTP Request with appropriate auth.",{"type":42,"tag":173,"props":394,"children":395},{},[396,407,418],{"type":42,"tag":62,"props":397,"children":398},{},[399,405],{"type":42,"tag":74,"props":400,"children":402},{"className":401},[],[403],{"type":48,"value":404},"references\u002FFINDING_API_DOCS.md",{"type":48,"value":406},": discovering auth scheme, base URL, common shapes.",{"type":42,"tag":62,"props":408,"children":409},{},[410,416],{"type":42,"tag":74,"props":411,"children":413},{"className":412},[],[414],{"type":48,"value":415},"references\u002FHTTP_REQUEST_WITH_AUTH.md",{"type":48,"value":417},": wiring HTTP Request to a credential.",{"type":42,"tag":62,"props":419,"children":420},{},[421,426],{"type":42,"tag":74,"props":422,"children":424},{"className":423},[],[425],{"type":48,"value":209},{"type":48,"value":427},": when built-in auth types don't fit.",{"type":42,"tag":51,"props":429,"children":431},{"id":430},"reference-files",[432],{"type":48,"value":433},"Reference files",{"type":42,"tag":435,"props":436,"children":437},"table",{},[438,457],{"type":42,"tag":439,"props":440,"children":441},"thead",{},[442],{"type":42,"tag":443,"props":444,"children":445},"tr",{},[446,452],{"type":42,"tag":447,"props":448,"children":449},"th",{},[450],{"type":48,"value":451},"File",{"type":42,"tag":447,"props":453,"children":454},{},[455],{"type":48,"value":456},"Read when",{"type":42,"tag":458,"props":459,"children":460},"tbody",{},[461,478,494,510],{"type":42,"tag":443,"props":462,"children":463},{},[464,473],{"type":42,"tag":465,"props":466,"children":467},"td",{},[468],{"type":42,"tag":74,"props":469,"children":471},{"className":470},[],[472],{"type":48,"value":276},{"type":42,"tag":465,"props":474,"children":475},{},[476],{"type":48,"value":477},"You need to understand how credentials are stored, referenced, scoped, or rotated",{"type":42,"tag":443,"props":479,"children":480},{},[481,489],{"type":42,"tag":465,"props":482,"children":483},{},[484],{"type":42,"tag":74,"props":485,"children":487},{"className":486},[],[488],{"type":48,"value":209},{"type":42,"tag":465,"props":490,"children":491},{},[492],{"type":48,"value":493},"Multi-header \u002F header-plus-query auth in one credential, or per-request signing patterns (HMAC, JWT, webhook validation)",{"type":42,"tag":443,"props":495,"children":496},{},[497,505],{"type":42,"tag":465,"props":498,"children":499},{},[500],{"type":42,"tag":74,"props":501,"children":503},{"className":502},[],[504],{"type":48,"value":415},{"type":42,"tag":465,"props":506,"children":507},{},[508],{"type":48,"value":509},"Configuring HTTP Request with auth: Bearer, Basic, OAuth, Header Auth",{"type":42,"tag":443,"props":511,"children":512},{},[513,521],{"type":42,"tag":465,"props":514,"children":515},{},[516],{"type":42,"tag":74,"props":517,"children":519},{"className":518},[],[520],{"type":48,"value":404},{"type":42,"tag":465,"props":522,"children":523},{},[524],{"type":48,"value":525},"The user mentioned a service you don't have node-level knowledge of",{"type":42,"tag":51,"props":527,"children":529},{"id":528},"anti-patterns",[530],{"type":48,"value":531},"Anti-patterns",{"type":42,"tag":435,"props":533,"children":534},{},[535,556],{"type":42,"tag":439,"props":536,"children":537},{},[538],{"type":42,"tag":443,"props":539,"children":540},{},[541,546,551],{"type":42,"tag":447,"props":542,"children":543},{},[544],{"type":48,"value":545},"Anti-pattern",{"type":42,"tag":447,"props":547,"children":548},{},[549],{"type":48,"value":550},"What goes wrong",{"type":42,"tag":447,"props":552,"children":553},{},[554],{"type":48,"value":555},"Fix",{"type":42,"tag":458,"props":557,"children":558},{},[559,609,627,688,714,732,765],{"type":42,"tag":443,"props":560,"children":561},{},[562,583,588],{"type":42,"tag":465,"props":563,"children":564},{},[565,567,573,575,581],{"type":48,"value":566},"Pasting ",{"type":42,"tag":74,"props":568,"children":570},{"className":569},[],[571],{"type":48,"value":572},"sk-...",{"type":48,"value":574}," into HTTP Request's ",{"type":42,"tag":74,"props":576,"children":578},{"className":577},[],[579],{"type":48,"value":580},"Authorization",{"type":48,"value":582}," header value field",{"type":42,"tag":465,"props":584,"children":585},{},[586],{"type":48,"value":587},"Token in plain text in the workflow JSON, leaks on export, copy, screenshot",{"type":42,"tag":465,"props":589,"children":590},{},[591,593,599,601,607],{"type":48,"value":592},"Use a credential: ",{"type":42,"tag":74,"props":594,"children":596},{"className":595},[],[597],{"type":48,"value":598},"Bearer Auth",{"type":48,"value":600}," for bearer tokens, ",{"type":42,"tag":74,"props":602,"children":604},{"className":603},[],[605],{"type":48,"value":606},"Header Auth",{"type":48,"value":608}," for other custom auth schemes",{"type":42,"tag":443,"props":610,"children":611},{},[612,617,622],{"type":42,"tag":465,"props":613,"children":614},{},[615],{"type":48,"value":616},"Storing token in a Set node and referencing via expression",{"type":42,"tag":465,"props":618,"children":619},{},[620],{"type":48,"value":621},"Same problem, value lives in workflow JSON",{"type":42,"tag":465,"props":623,"children":624},{},[625],{"type":48,"value":626},"Same fix: credential, not a Set node",{"type":42,"tag":443,"props":628,"children":629},{},[630,643,648],{"type":42,"tag":465,"props":631,"children":632},{},[633,635,641],{"type":48,"value":634},"Storing a secret in ",{"type":42,"tag":74,"props":636,"children":638},{"className":637},[],[639],{"type":48,"value":640},"$vars.X",{"type":48,"value":642}," and reading it as the auth value",{"type":42,"tag":465,"props":644,"children":645},{},[646],{"type":48,"value":647},"Not encrypted at rest, leaks in exports, no rotation",{"type":42,"tag":465,"props":649,"children":650},{},[651,653,659,661,667,668,673,675,680,682],{"type":48,"value":652},"Use the right credential type (",{"type":42,"tag":74,"props":654,"children":656},{"className":655},[],[657],{"type":48,"value":658},"httpBearerAuth",{"type":48,"value":660},", ",{"type":42,"tag":74,"props":662,"children":664},{"className":663},[],[665],{"type":48,"value":666},"httpHeaderAuth",{"type":48,"value":660},{"type":42,"tag":74,"props":669,"children":671},{"className":670},[],[672],{"type":48,"value":201},{"type":48,"value":674},", or the native one). For inbound webhook auth, use the trigger's ",{"type":42,"tag":74,"props":676,"children":678},{"className":677},[],[679],{"type":48,"value":22},{"type":48,"value":681}," field, not an IF on ",{"type":42,"tag":74,"props":683,"children":685},{"className":684},[],[686],{"type":48,"value":687},"$vars.token",{"type":42,"tag":443,"props":689,"children":690},{},[691,704,709],{"type":42,"tag":465,"props":692,"children":693},{},[694,696,702],{"type":48,"value":695},"Reaching for ",{"type":42,"tag":74,"props":697,"children":699},{"className":698},[],[700],{"type":48,"value":701},"$env.X",{"type":48,"value":703}," to read a secret during custom auth setup",{"type":42,"tag":465,"props":705,"children":706},{},[707],{"type":48,"value":708},"Doesn't work, throws at runtime",{"type":42,"tag":465,"props":710,"children":711},{},[712],{"type":48,"value":713},"Use a credential of the appropriate type",{"type":42,"tag":443,"props":715,"children":716},{},[717,722,727],{"type":42,"tag":465,"props":718,"children":719},{},[720],{"type":48,"value":721},"Using HTTP Request when a native node exists",{"type":42,"tag":465,"props":723,"children":724},{},[725],{"type":48,"value":726},"Loses auto-refresh on OAuth, loses native error handling, more code",{"type":42,"tag":465,"props":728,"children":729},{},[730],{"type":48,"value":731},"Use the native node",{"type":42,"tag":443,"props":733,"children":734},{},[735,748,753],{"type":42,"tag":465,"props":736,"children":737},{},[738,740,746],{"type":48,"value":739},"Hardcoding credentials in SDK code (",{"type":42,"tag":74,"props":741,"children":743},{"className":742},[],[744],{"type":48,"value":745},"new HttpRequest({ headers: { Authorization: 'Bearer xxx' } })",{"type":48,"value":747},")",{"type":42,"tag":465,"props":749,"children":750},{},[751],{"type":48,"value":752},"Same leak surface",{"type":42,"tag":465,"props":754,"children":755},{},[756,758,763],{"type":48,"value":757},"Use ",{"type":42,"tag":74,"props":759,"children":761},{"className":760},[],[762],{"type":48,"value":79},{"type":48,"value":764}," in SDK code",{"type":42,"tag":443,"props":766,"children":767},{},[768,777,782],{"type":42,"tag":465,"props":769,"children":770},{},[771,773],{"type":48,"value":772},"Asking the user to create a credential without naming the credential ",{"type":42,"tag":159,"props":774,"children":775},{},[776],{"type":48,"value":163},{"type":42,"tag":465,"props":778,"children":779},{},[780],{"type":48,"value":781},"User picks the wrong type, auth fails confusingly",{"type":42,"tag":465,"props":783,"children":784},{},[785,787,793],{"type":48,"value":786},"Always specify: \"create a credential of type ",{"type":42,"tag":74,"props":788,"children":790},{"className":789},[],[791],{"type":48,"value":792},"\u003Cexact type name>",{"type":48,"value":323},{"items":795,"total":890},[796,812,825,841,849,864,877],{"slug":797,"name":797,"fn":798,"description":799,"org":800,"tags":801,"stars":26,"repoUrl":27,"updatedAt":811},"n8n-agents-official","build AI agents in n8n","Use when building or editing any AI feature in n8n: AI Agents, Text Classifier, Information Extractor, Sentiment Analysis, Summarization Chain, Basic LLM Chain, embeddings, vector stores, single one-shot LLM calls, or AI media generation (image \u002F audio \u002F video) via the native LangChain provider nodes. Triggers on any `@n8n\u002Fn8n-nodes-langchain.*` node, \"agent\", \"chat assistant\", \"LLM with tools\", \"tool calling\", \"fromAi\", \"system prompt\", \"memory window\", \"structured output\", \"outputParser\", \"function calling\", \"RAG\", \"vector store\", \"embeddings\", \"classify with AI\", \"extract fields with LLM\", \"sentiment analysis\", \"summarize with LLM\", \"single LLM call\", chat triggers with files, AI image \u002F video \u002F audio generation, or any multi-turn or one-shot LLM behavior.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[802,805,808],{"name":803,"slug":804,"type":15},"Agents","agents",{"name":806,"slug":807,"type":15},"LLM","llm",{"name":809,"slug":810,"type":15},"Workflow Automation","workflow-automation","2026-07-08T05:44:47.938896",{"slug":813,"name":813,"fn":814,"description":815,"org":816,"tags":817,"stars":26,"repoUrl":27,"updatedAt":824},"n8n-binary-and-data-official","handle binary data and files in n8n","Use when handling files, images, attachments, or binary data in n8n, OR when an AI agent needs to take a user-uploaded file as tool input or return a generated file. For Data Tables (schemas, dedup, persistent state), see the separate n8n-data-tables-official skill. Triggers on \"file\", \"image\", \"PDF\", \"attachment\", \"binary\", \"upload\", \"download\", chat trigger with files, agent tool that needs a file, vision\u002Fmultimodal, or any handling of non-JSON file data.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[818,819,822,823],{"name":18,"slug":19,"type":15},{"name":820,"slug":821,"type":15},"File Uploads","file-uploads",{"name":8,"slug":8,"type":15},{"name":809,"slug":810,"type":15},"2026-07-08T05:45:01.884342",{"slug":826,"name":826,"fn":827,"description":828,"org":829,"tags":830,"stars":26,"repoUrl":27,"updatedAt":840},"n8n-code-nodes-official","write custom logic in n8n","Use when the user reaches for a Code node, mentions writing JavaScript or Python in n8n, or any custom logic comes up in workflow design. Triggers on \"Code node\", \"Code\", \"JavaScript\", \"Python\", \"custom logic\", \"transform data\", \"$input\", \"$json transformation\", \"loop in code\", \"write a function\", or any time the obvious answer seems to be \"just put it in code.\"",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[831,834,837],{"name":832,"slug":833,"type":15},"Engineering","engineering",{"name":835,"slug":836,"type":15},"JavaScript","javascript",{"name":838,"slug":839,"type":15},"Python","python","2026-07-08T05:44:49.656127",{"slug":4,"name":4,"fn":5,"description":6,"org":842,"tags":843,"stars":26,"repoUrl":27,"updatedAt":28},{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[844,845,846,847,848],{"name":21,"slug":22,"type":15},{"name":18,"slug":19,"type":15},{"name":8,"slug":8,"type":15},{"name":24,"slug":25,"type":15},{"name":13,"slug":14,"type":15},{"slug":850,"name":850,"fn":851,"description":852,"org":853,"tags":854,"stars":26,"repoUrl":27,"updatedAt":863},"n8n-data-tables-official","manage n8n Data Tables","Use when working with n8n's built-in Data Tables, designing schemas, inserting\u002Fupdating\u002Fupserting rows, deduping, or querying. Triggers on \"Data Table\", \"data table\", `n8n-nodes-base.dataTable`, \"dedup\", \"idempotency\", \"lookup\", \"persistent state\", \"store across executions\", or any schema design discussion inside n8n.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[855,858,861,862],{"name":856,"slug":857,"type":15},"Data Modeling","data-modeling",{"name":859,"slug":860,"type":15},"Database","database",{"name":8,"slug":8,"type":15},{"name":809,"slug":810,"type":15},"2026-07-08T05:44:52.048039",{"slug":865,"name":865,"fn":866,"description":867,"org":868,"tags":869,"stars":26,"repoUrl":27,"updatedAt":876},"n8n-debugging-official","debug and fix n8n workflow errors","Use when an n8n workflow isn't working, errors appear, results don't match what was expected, or the user says \"this isn't working.\" Triggers on errors, unexpected output, \"it's not working\", \"why is this happening\", \"the workflow stopped\", failure investigation, or any debugging context.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[870,871,874,875],{"name":18,"slug":19,"type":15},{"name":872,"slug":873,"type":15},"Debugging","debugging",{"name":8,"slug":8,"type":15},{"name":809,"slug":810,"type":15},"2026-07-08T05:45:05.897341",{"slug":878,"name":878,"fn":879,"description":880,"org":881,"tags":882,"stars":26,"repoUrl":27,"updatedAt":889},"n8n-error-handling-official","implement error handling in n8n","Use when building any webhook-triggered workflow, scheduled\u002Fproduction-bound workflow, wiring a per-node error output, or any workflow where silent failure would drop user-visible work. Triggers on \"webhook\", \"respond to webhook\", \"API\", \"production\", \"error\", \"failure\", \"5xx\", \"try\u002Fcatch\", \"error workflow\", \"onError\", \"continueErrorOutput\", \"error branch\", \"node error output\", \"output(1)\", \"main[1]\", \"scheduled\", or any workflow that runs unattended.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[883,884,885,888],{"name":872,"slug":873,"type":15},{"name":8,"slug":8,"type":15},{"name":886,"slug":887,"type":15},"Operations","operations",{"name":809,"slug":810,"type":15},"2026-07-08T05:44:59.710099",14,{"items":892,"total":1031},[893,910,923,934,944,955,968,984,993,1005,1015,1025],{"slug":894,"name":894,"fn":895,"description":896,"org":897,"tags":898,"stars":907,"repoUrl":908,"updatedAt":909},"config-evals","configure workflow evaluations","Builds and maintains configuration-based evaluations on a workflow with the eval-config tool. Use when the user asks to set up, add, view, change, or remove an evaluation, score, grade, or judge a workflow's output, or measure answer quality against a test dataset. This is the only eval form Instance AI handles — it does not touch on-canvas evaluation nodes.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[899,902,903,906],{"name":900,"slug":901,"type":15},"Evals","evals",{"name":8,"slug":8,"type":15},{"name":904,"slug":905,"type":15},"Testing","testing",{"name":809,"slug":810,"type":15},198156,"https:\u002F\u002Fgithub.com\u002Fn8n-io\u002Fn8n","2026-07-24T05:37:07.398695",{"slug":911,"name":911,"fn":912,"description":913,"org":914,"tags":915,"stars":907,"repoUrl":908,"updatedAt":922},"credential-setup-with-computer-use","configure n8n credentials via browser","Guides n8n credential setup through Computer Use browser tools. Use when a user needs OAuth apps, API keys, client IDs, client secrets, or other credential values from an external service console.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[916,917,920,921],{"name":18,"slug":19,"type":15},{"name":918,"slug":919,"type":15},"Configuration","configuration",{"name":8,"slug":8,"type":15},{"name":24,"slug":25,"type":15},"2026-06-30T07:40:45.54",{"slug":924,"name":924,"fn":851,"description":925,"org":926,"tags":927,"stars":907,"repoUrl":908,"updatedAt":933},"data-table-manager","Load before calling data-tables or parse-file. Use for natural standalone requests like \"what data tables do I have?\", \"show\u002Flist my tables\", or \"what columns are in this table?\", and whenever the user asks to list, show, create, inspect, import, seed, query, update, clean up, rename columns in, or delete data tables and rows, especially from CSV\u002FXLSX\u002FJSON attachments. Also load before building or planning workflows that create or write to Data Tables (then load workflow-builder before build-workflow).",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[928,931,932],{"name":929,"slug":930,"type":15},"Data Engineering","data-engineering",{"name":859,"slug":860,"type":15},{"name":8,"slug":8,"type":15},"2026-07-27T06:07:14.648144",{"slug":935,"name":935,"fn":936,"description":937,"org":938,"tags":939,"stars":907,"repoUrl":908,"updatedAt":922},"debugging-executions","debug failed n8n workflow executions","Debug failed or wrong-output workflow executions using executions tools. Load when the user reports execution failures, unexpected node output, empty parameter values after a successful run, or a node showing a red or failed expression error.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[940,941,942,943],{"name":18,"slug":19,"type":15},{"name":872,"slug":873,"type":15},{"name":8,"slug":8,"type":15},{"name":809,"slug":810,"type":15},{"slug":945,"name":945,"fn":946,"description":947,"org":948,"tags":949,"stars":907,"repoUrl":908,"updatedAt":954},"intent-recognition","classify automation requests by control flow","Classifies automation requests using two decisions: anchor (which primitive owns the top-level control flow — workflow-anchored, agent-anchored, needs-clarification, or out-of-scope) and embeds_other (whether the other primitive appears embedded inside — an agent step inside a workflow, or a workflow invoked as an agent tool). Must be used before deciding the intent of any automation request, including compound requests with multiple independent automations, mid-build extensions to an existing workflow or agent, one-off questions or reports that need external systems you cannot query directly, and requests that need clarification before an anchor can be chosen, before choosing workflow-builder, planning, or an agent-oriented design.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[950,951,952,953],{"name":803,"slug":804,"type":15},{"name":18,"slug":19,"type":15},{"name":8,"slug":8,"type":15},{"name":809,"slug":810,"type":15},"2026-07-30T05:30:06.772347",{"slug":956,"name":956,"fn":957,"description":958,"org":959,"tags":960,"stars":907,"repoUrl":908,"updatedAt":967},"n8n-cli","manage n8n workflows from the CLI","Use the n8n CLI to manage workflows, credentials, executions, and more on an n8n instance. Use when the user asks to interact with n8n, automate workflows, manage credentials, or operate their instance from the command line.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[961,962,965,966],{"name":18,"slug":19,"type":15},{"name":963,"slug":964,"type":15},"CLI","cli",{"name":8,"slug":8,"type":15},{"name":809,"slug":810,"type":15},"2026-04-06T18:38:40.360123",{"slug":969,"name":969,"fn":970,"description":971,"org":972,"tags":973,"stars":907,"repoUrl":908,"updatedAt":983},"n8n-docs-assistant","retrieve n8n documentation and guidance","Answers n8n product, setup, credential, node, hosting, API, and usage questions from current n8n docs. Load n8n-docs via load_tool before calling it (search \"n8n docs\" if not visible). Use when the user asks how to configure, set up, troubleshoot, or understand n8n behavior, especially credential setup questions opened from the credential modal.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[974,977,978,980],{"name":975,"slug":976,"type":15},"Documentation","documentation",{"name":8,"slug":8,"type":15},{"name":979,"slug":263,"type":15},"Reference",{"name":981,"slug":982,"type":15},"Search","search","2026-07-27T06:07:15.692906",{"slug":985,"name":985,"fn":986,"description":987,"org":988,"tags":989,"stars":907,"repoUrl":908,"updatedAt":922},"planned-task-runtime","manage n8n task runtimes","Handles system follow-up turns: planned-task-follow-up (synthesize, replan, build-workflow, checkpoint), background-task-completed, running-tasks context, and create-tasks silence rules. Load whenever any of these tags appear or after calling create-tasks.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[990,991,992],{"name":18,"slug":19,"type":15},{"name":8,"slug":8,"type":15},{"name":809,"slug":810,"type":15},{"slug":994,"name":994,"fn":995,"description":996,"org":997,"tags":998,"stars":907,"repoUrl":908,"updatedAt":1004},"planning","coordinate multi-artifact workflows","ONLY for coordinated multi-artifact work: multiple workflows with dependencies, shared data-table schema\u002Fmigration across tasks, or the user explicitly asked to review a plan first. Load create-tasks via load_tool before calling it (search \"create tasks\" if not visible). Do NOT use for new one-off workflows, single-workflow edits, verification-only requests, or standalone data-table ops — use workflow-builder or data-table-manager instead.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[999,1000,1001,1003],{"name":18,"slug":19,"type":15},{"name":8,"slug":8,"type":15},{"name":1002,"slug":994,"type":15},"Planning",{"name":809,"slug":810,"type":15},"2026-07-27T06:07:16.673218",{"slug":1006,"name":1006,"fn":1007,"description":1008,"org":1009,"tags":1010,"stars":907,"repoUrl":908,"updatedAt":1014},"post-build-flow","verify and set up n8n workflows","Handles workflow verification and setup after build-workflow succeeds, or when the message contains workflow-verification-follow-up or workflow-setup-required. Load after direct builds, when verificationReadiness requires action, or on orchestrator verify\u002Fsetup follow-up turns.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[1011,1012,1013],{"name":18,"slug":19,"type":15},{"name":8,"slug":8,"type":15},{"name":809,"slug":810,"type":15},"2026-07-24T05:37:08.421329",{"slug":1016,"name":1016,"fn":1017,"description":1018,"org":1019,"tags":1020,"stars":907,"repoUrl":908,"updatedAt":1024},"workflow-builder","build and edit n8n workflows","Load before calling build-workflow. Default path for all single-workflow work: new one-off workflows, existing-workflow edits, verification repairs, and workflow-local data tables. Write or edit a workspace source file, then call build-workflow with filePath. When the workflow creates or writes Data Tables, load data-table-manager first, then this skill. Do not load planning or create-tasks first. Load planning only when multiple coordinated workflows or shared cross-task data tables require a dependency-aware task graph.",{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[1021,1022,1023],{"name":18,"slug":19,"type":15},{"name":8,"slug":8,"type":15},{"name":809,"slug":810,"type":15},"2026-07-30T05:30:07.798011",{"slug":797,"name":797,"fn":798,"description":799,"org":1026,"tags":1027,"stars":26,"repoUrl":27,"updatedAt":811},{"slug":8,"name":8,"logoUrl":9,"githubOrg":10},[1028,1029,1030],{"name":803,"slug":804,"type":15},{"name":806,"slug":807,"type":15},{"name":809,"slug":810,"type":15},25]