Credentials and OAuth: Connecting Your Apps

What Credentials Are

When n8n talks to Google, Slack, or any other service on your behalf, it needs proof that it is authorised to do so. That proof is called a credential. Credentials are stored securely in n8n (encrypted at rest) and referenced by name inside your nodes. You create them once and reuse them across every workflow that needs that service.

n8n supports three main authentication patterns: OAuth2 (Google, Slack, HubSpot, and most modern SaaS apps), API Key (OpenAI, Airtable, many developer-focused services), and Basic Auth / username + password (older systems). The most common one you will encounter is OAuth2.

Setting Up Google OAuth2

Google credentials cover Gmail, Google Sheets, Google Drive, Google Calendar, and other Google Workspace services. There are two paths:

• Managed OAuth (n8n Cloud only) — Click "Sign in with Google" inside n8n. No Google Cloud Console setup required. This is the fastest path if you are on n8n Cloud.
• Custom OAuth2 (Cloud and self-hosted) — You create an OAuth2 app in Google Cloud Console and paste the Client ID and Client Secret into n8n. Required for self-hosted and recommended for production use.

For Custom OAuth2: go to console.cloud.google.com, create a project, enable the APIs you need (Sheets API, Gmail API, etc.), create OAuth 2.0 credentials under APIs & Services → Credentials, and add the redirect URI that n8n shows you in the credential setup screen. Then paste the Client ID and Client Secret into n8n and click Connect.

Setting Up an API Key Credential

API key credentials are simpler. In your n8n node (for example, OpenAI), click the Credential dropdown, select "Create New", paste your API key, and save. n8n stores it encrypted and uses it automatically whenever that node runs. The API key never appears in plain text after you save it.

Where Credentials Live

Credentials are managed in the Credentials section of the left sidebar. You can see all your credentials, edit them, and check which workflows use each one. When you rename or delete a credential, n8n shows you which workflows will be affected.

One important rule: credentials are scoped to a project (or to your personal workspace on the Starter plan). Team members in the same project can use shared credentials without ever seeing the underlying keys — they just see the credential name and can select it in their nodes.

Common Connection Issues

Most credential problems come from one of three causes: the wrong redirect URI (check that you copied n8n's exact callback URL into your OAuth app), missing API scopes (you authorised the credential but didn't enable the right permissions — re-authorise with the correct scopes), or an expired token (OAuth tokens expire; click Reconnect in the credential to get a fresh one). When a workflow fails with an authentication error, always check the credential first.