Credentials, access and safe changes
🎯You'll be able to
Name, own and limit credentials, use business-owned accounts, and change live workflows safely.
🏠The everyday picture
A shop gives the delivery boy a key to the stockroom, not to the cash drawer. When he leaves, the shop collects the key. And the owner doesn't rearrange the shop in the middle of the Diwali rush.
📘What it really is
- Credentials: store keys and passwords in the platform's credentials store (DA5). Give each one a clear name and an owner.
-
Least access: connect with accounts that can do only what the workflow needs. A workflow that reads orders doesn't need permission to delete them.
-
Company accounts: connect services with business-owned accounts, not a staff member's personal login, so access survives when people leave.
-
Expiry: some tokens expire. Note the dates and set a reminder before they lapse.
- Safe changes:
- test changes on a copy of the workflow with test data before changing the live one;
- keep versions (n8n's version history or exported files) so you can go back;
- make changes at quiet times, and note what changed and why.
📝A worked example
Sharma Textiles' credentials list after a review:
| Credential | Account | Access | Owner | Renew by |
|---|---|---|---|---|
| Shop API | sharma-automation (company) | Read orders | Ravi | No expiry |
| Payment gateway | Company account | Read payments, webhooks | Priya | Key rotated yearly |
| Google Sheets | Company service account | Two named sheets only | Ravi | No expiry |
| WhatsApp API | Business account | Send templates | Ravi | Token: 15 March |
The review found the sheets connection used a former employee's personal Google account. It was moved to a company service account before that person's account was closed.
🌍Where it's used
- Client handovers: a credentials list with owners and dates.
- Staff changes: removing access when people leave.
- Audits and data protection: showing who can reach which data.
- Busy seasons: freezing big changes during sale periods.
📝Case scenario
A shop manager edits the live order workflow on the first morning of the Diwali sale to add a new field, and a typo stops orders flowing for an hour. You set a rule: changes are made on a copy, tested with pinned data, and published at quiet times, with a version saved first. Big changes are frozen during sale weeks.
🖱️Try it
Make a credentials list for your workflows like the one above. Check that each connection uses a business-owned account with only the access it needs, and note any token expiry dates.
⚠️Common mistakes
- One all-powerful key. Sign: a read-only workflow can delete records. Fix: create a key with only the access needed.
- Editing the live workflow directly. Sign: a typo stops payments mid-day. Fix: change a copy, test it, then switch over.
🛠️For your project
The capstone handover pack includes a credentials list (names, access, owner, last rotated; never the values). Start it now.
✅Quick check
Why connect services with company accounts rather than personal ones?
Show the answer
So the workflows keep working, and access stays under the business's control, when people leave.
Where should you test a change to a live workflow?
Show the answer
On a copy with test data, before publishing it to the live workflow.