Credentials
Stored API keys and OAuth logins for each app, kept out of your workflow logic.
Last updated
Analogy
Environment variables with a UI, plus someone else wrote all the OAuth refresh code.
In an agent
Keeps OAuth and app-specific auth out of your agent code entirely.
Questions people ask
How does n8n store API keys and logins?
n8n keeps API keys and OAuth logins as credentials, stored separately from workflows and encrypted. Nodes reference a credential by name, so keys never appear in the workflow itself. For OAuth apps, n8n also handles refreshing tokens, which you would otherwise have to code yourself.
Why keep app authentication in n8n instead of the agent?
It keeps the agent's code simple and safer. The agent calls an n8n webhook; n8n holds the Slack, Jira or Google credentials and handles OAuth refresh. The agent never sees those tokens, so a confused or tricked agent cannot leak them, and you can rotate keys without redeploying.