n8n Security Checklist: Credentials, Webhooks and Access

Automations touch your customers, money and accounts, so security matters.

Credentials

• Store secrets only in n8n credentials, not in nodes or code.
• Keep the encryption key backed up and private.
• Use keys with minimum permissions and rotate them if exposed.

Webhooks

• Use authentication where the sender supports it.
• Validate input and ignore unexpected fields.
• Use non-guessable paths for private endpoints.
• See webhook basics.

Access

Use strong passwords, limit who can edit workflows and remove people who leave.

Server

Use HTTPS, keep the system and n8n updated (backups and updates) and expose only what is needed.

Data

Collect only needed personal data, set retention for execution data and avoid sending sensitive data to AI providers without good reason.

Review regularly

Check active workflows, credentials and users every few months.

Quick answers

How do I protect credentials?

Store them only in n8n credentials, use minimum permissions and rotate when exposed.

Are webhooks safe?

Only if you add authentication and validate input.

How often should I review access?

Every few months and when people leave.

---

Related reading

• How to Self-Host n8n with Docker: A Practical Overview
• How to Back Up and Update n8n Safely
• n8n Queue Mode and Scaling Explained for Beginners