The credential and the workflow are separate things

When you dropped a Slack node onto the canvas in Part 8, n8n made you pick a Credential to connect with. What sits in that dropdown is a credential: one SaaS account authorization that n8n holds for you. Without it the Slack node still throws Authentication failed at run time, even when every other parameter is filled in correctly.

In one sentence, a credential is the set of account authorization details n8n keeps for you, so a node can pull them out automatically when it calls an outside service. Think of your browser's saved passwords, but for workflows. Four properties matter more than anything else you will read about them.

A node inside a workflow stores only a reference: which credential id I use. The token value itself is not in the workflow file. That is the whole design, and it is why you can hand a workflow JSON to a colleague without handing over anything sensitive.

flowchart TD
  subgraph W["Safe to hand around"]
    direction LR
    A["workflow_entity table:
the workflow JSON"] --> B["A node holding only
a credential id"]
  end
  subgraph C["Never leaves the instance"]
    direction LR
    D["credentials table"] --> E["An encrypted blob:
token, API key, refresh token"]
    F["N8N_ENCRYPTION_KEY
from the environment"] --> E
  end
  B -.->|"looked up by id at run time"| D

This split buys you two concrete things. Sharing a workflow with a colleague leaks no token. And changing a token — a refresh, a different account — means editing one credential, after which every workflow that references it picks up the new value automatically. You do not go around editing nodes one at a time.

Put the two side by side and the design stops being abstract. They live in the same database, in different tables, and everything else follows from that.

The export row is the one that catches people out. A workflow comes out of n8n as a file you can put in git, and that is exactly why the token must not be in it.

The Credentials page is at the bottom of the sidebar. In some versions the icon is a little key. Click in and you get a table listing every credential in your workspace with its name, its type and its last-modified time.

Two types cover almost everything

There are hundreds of credential types in n8n. They fall into two groups, and once you recognize those two you can handle almost anything you meet.

Two rarer variants exist as well. Do not be alarmed when you meet them. Basic Auth takes a username and password directly, and is common on older internal APIs and some corporate LDAP setups. Header Auth or Custom Auth covers non-standard APIs that want a special field in the header — it is the usual partner for the HTTP Request node from Part 9 when you call an API in the wild.

Hands-on: a Google OAuth2 credential

The most common situation at work: one workflow has to read and write Google Sheets, send Gmail and store files on Drive, all authorized by the same Google account. Walk through it once and you have it for good.

sequenceDiagram
  participant U as You
  participant N as n8n credential page
  participant G as Google consent screen
  U->>N: Paste the Client ID and Client Secret
  U->>N: Press Sign in with Google
  N->>G: Open a popup at the provider
  U->>G: Pick an account, read the access list, press Allow
  G-->>N: Redirect back to the OAuth Redirect URL
  N-->>U: Green check, and Account connected
  Note over N: The token is written into the credentials table, encrypted

1. Step 1

   Credentials, then a new credential

   Click Credentials in the sidebar, then Add credential at the top right. On an empty workspace the button in the middle says Create new credential instead. Either way a “Select credential type” search box opens.

2. Step 2

   Search for Google, then pick the matching type

   Type google and a pile of options appears: Google OAuth2 API (the generic one), Google Sheets OAuth2 API, Gmail OAuth2 API, Google Drive OAuth2 API and more.

   The rule is simple: pick the OAuth2 credential that matches the node you are going to use. It is all Google OAuth underneath, but the scopes differ. For the Gmail node, pick Gmail OAuth2 API.

3. Step 3

   Get a Client ID and Client Secret

   If this is your first one, n8n asks for a Client ID and a Client Secret. You get both by creating an OAuth 2.0 Client ID at console.cloud.google.com. The path is Create a Project → APIs & Services → Credentials → Create Credentials → OAuth client ID → Web application.

   On that Google form there is an Authorized redirect URIs box. Into it goes the OAuth Redirect URL that the n8n credential page is showing you — something with this shape:

   https://your-n8n.example.com/rest/oauth2-credential/callback

   Read your own off your own credential page. Do not type the one printed here; the host part is different for every installation. Save the Google form and you have your Client ID and Client Secret.

   Or skip this step entirely. WoowTech IT has already built a shared OAuth Client. Ask them for the Client ID and Client Secret rather than opening a new Project of your own. Sharing one keeps quota management and audit logs in a single place.
4. Step 4

   Paste them into n8n

   Back in the credential form, put the Client ID in the Client ID field and the Client Secret in the Client Secret field. Leave Scope at its default in most cases — each credential type ships with the scopes people usually need. Gmail OAuth includes send, read and labels; Sheets OAuth includes read and write.

5. Step 5

   Sign in with Google, then Allow

   Press Sign in with Google at the top right. Other versions label the same button Connect my account or just OAuth2, so recognize the position rather than the word.

   A new window opens on the Google consent screen. Pick your Google account, read the “n8n wants to access your Gmail…” list rather than clicking past it, then press Allow. When the popup closes, the n8n page shows a green check and Account connected.

6. Step 6

   Name it so a stranger could identify it

   Change the credential name at the top to something recognizable — Gmail ([email protected]) or Google Sheets - CS team. Press Save. From now on that name is what appears in the Credential dropdown of your Gmail, Sheets and Drive nodes.

Hands-on: an API key credential

The API Key type is far simpler. No bouncing between sites, just one key pasted in. OpenAI as the example:

1. Step 1

   Create the key in the provider's console

   Sign in at platform.openai.com/api-keys, press Create new secret key, give it a name such as n8n-woow-prod, and choose All permissions — or read-only, if that is genuinely all you need.

   The key is shown exactly once. If you do not copy it now you can never get it back, so paste it into n8n immediately rather than into a scratch file you mean to delete later.

2. Step 2

   New credential, search for OpenAI

   Back in n8n: sidebar Credentials → Add credential, type openai in the search box, pick OpenAI.

3. Step 3

   Paste the key and name it

   There is a single API Key field. Paste the key. Organization ID can usually stay empty, unless you belong to several OpenAI organizations and have to name one.

   Rename the credential to something like OpenAI (marketing team) and press Save. Done, and much faster than OAuth.

Three ways to share, and the one most teams cannot use

Not everyone at a company wires up workflows with their own Google account. Usually a team shares one address like [email protected], or uses a role account such as a Slack Bot. n8n's sharing model is the opposite of what most people expect: the default is whoever created it owns it, not shared across the company.

So what do you actually do? It depends on which edition you are on, and there is no clever workaround for the first case.

Two workflows that need different Slack accounts are not a problem, incidentally. Create two credentials — Slack Bot - #ops-alerts for one account and Slack Bot - #marketing for the other — and the Slack node in each workflow picks the matching one from its Credential dropdown. A hundred Slack credentials under one workspace is fine.

The key you must not lose

Three questions IT always asks: where does it live, how does the encryption work, and what does a backup have to include. All three in one pass, because the third one is the one that ruins weekends.

In a queue mode deployment, set N8N_ENCRYPTION_KEY by hand and give every worker the same value. Workers that do not share the key cannot decrypt the credentials, and the symptom is a fleet of workers that all fail authentication for no visible reason.

WoowTech's standard backup routine goes one item further than that minimum, and it is worth copying:

Newer n8n versions offer encryption key rotation, which is worth knowing about before you need it. Set N8N_ENV_FEAT_ENCRYPTION_KEY_ROTATION=true — it works on every self-hosted version. Once it is on, N8N_ENCRYPTION_KEY becomes a master key that protects an inner data key, and Settings → Data Encryption Keys in the UI lets you rotate that inner key. So you can change the credential encryption on a schedule without touching the master key.

The day-to-day life of a credential

Every credential goes through the same stages from creation to deletion. Learn them once and you can run dozens without breaking a sweat.

stateDiagram-v2
  [*] --> Created
  Created --> Working: saved and tested
  Working --> Expired: refresh fails
  Expired --> Working: Reconnect
  Working --> Deleted: Delete
  Deleted --> [*]
  note right of Deleted
    Every node that referenced it
    turns red: Credential ID not found
  end note

When credentials go wrong

The official documentation lives in three places worth bookmarking: the overview at docs.n8n.io/credentials/, the OAuth configuration detail at docs.n8n.io/hosting/configuration/oauth/, and sharing and permission management at docs.n8n.io/user-management/rbac/. Each credential type also has its own page describing which fields to fill in.

A dynamic fill-in-the-blank, in five forms

Credentials get a node connected. Expressions get data into it. Part 7 told you that what travels between n8n nodes is items, one row at a time — but knowing what an item looks like is not enough. When a downstream node actually needs the data, you have to put an upstream field into a field on that downstream node, and the bridge for that is the expression.

Here are everyday jobs you cannot build without one:

• Someone submits an order through a Google Form and Slack posts “New order #1042, customer Chen Xiaoming, amount $3,500”. Those three values come from upstream. You cannot hard-code them.
• Every day at 08:00 Gmail sends the “2026-08-16 daily sales report”, and the date has to be today, not the day you built it.
• An IF node condition: notify the manager only when the amount is over 1000. The value being compared has to be pulled from the current item's amount field.
• Adding a row to Google Sheets, where the name column takes the previous node's name and the Email column takes email.

Without expressions you could only build one workflow per customer, which reduces n8n to a very expensive cron job. Expressions are what make one workflow serve an unlimited number of records, and no other n8n feature saves you more time.

The idea itself is small. Every field inside a node — the Text field on the Slack node, say — can be filled in two ways.

flowchart TD
  A["A field on a node"] --> B{"Fixed or
Expression mode?"}
  B -->|"Fixed"| C["The text is sent
exactly as typed"]
  B -->|"Expression"| D["n8n evaluates everything
inside the braces first"]
  D --> E["The result is written
back into the field"]
  E --> F["The node runs
with a real value"]
  C --> F

How to switch: at the field label above the field, or on the field itself, there is an Expression / Fixed toggle. Newer builds show a small fx icon plus an Expression tab, so recognize the shape rather than the exact word. Left is Fixed, right is Expression. Once you switch, the field background turns into a gridded code style and a preview block appears underneath. That gridded background is the visual marker that you are in Expression mode.

A field can also mix static text with an expression. Say the field holds New order {{ $json.orderId }} — the static prefix is sent as it is, and only the braces section gets replaced. That is the most intuitive way to build a template string, and you will use it constantly.

The five you will use most

Eight cases out of ten come down to these five. Learn them well and everything else is a combination of them.

$json, $now and $() are built-in variables that n8n injects for you. They are not native JavaScript; n8n prepares them and you simply use them. Part 15 spells out the full list — for now, get comfortable with these few.

Build them by dragging instead of typing

Honestly, writing an expression almost never means typing code yourself. The expression editor has a good drag mechanism, so you do not have to remember any field name — one pull with the mouse and it is written correctly. This is the one trick every beginner should learn first, because dragging never misspells.

1. Step 1

   Run the upstream node once

   Click Execute step on the upstream node — the small play button underneath it — so it produces output. Without output, the expression editor does not know which fields exist and shows an empty schema.

2. Step 2

   Open the downstream node

   Double-click the node to open its settings panel and find the field you want to change. The Text field on a Slack node is the usual first one.

3. Step 3

   Switch the field into Expression mode

   Above the field there is a Fixed / Expression tab, or a small fx icon. Click the Expression side. The field background turns into a gridded code style, which is how you know the switch worked.

4. Step 4

   Drag a field in from the INPUT panel

   Once the expression editor opens, an INPUT panel slides out on the left listing every field from the upstream node. You can switch it between Table, JSON and Schema views. Drag a field straight into the expression box and n8n writes the correct form for you — drag name and you get {{ $json.name }}.

5. Step 5

   Check the Result preview

   Below the expression box is a Result: line showing, live, the value this expression evaluates to. The value you expected means you are done. Red text or an empty result means the expression has a problem, and section 07 is about reading those.

6. Step 6

   Type static text around it

   You can add static text before or after the expression you dragged in. If the box holds {{ $json.name }} and you type Hi in front, it becomes Hi {{ $json.name }} and the preview updates immediately to Hi Elmo.

The two things you will format most

Almost every expression you write beyond {{ $json.field }} is either a date or a string. Both have a small set of moves worth memorizing.

Dates and times: enter Luxon

n8n expressions handle time with Luxon, a JavaScript date library. Not the native Date, and not Moment. Luxon's advantages are timezone support and calendar arithmetic, with far tidier syntax than the native Date.

Every Luxon calendar unit works — days, hours, months, weeks, years — and you must not drop the plural s. The toFormat pattern is Luxon-specific too: yyyy is a four-digit year, MM a two-digit month, dd a two-digit day, HH the 24-hour clock, mm minutes.

Joining strings: three styles, one result

Slack messages, Gmail subjects and Sheets columns are all strings. To drop an upstream field into a sentence, n8n gives you three styles. They all achieve the same thing, so pick whichever reads best to you.

The string methods are all standard JavaScript, so nothing here is n8n-specific:

Cases you can copy

These are the ones that come up over and over. Open the workflow, switch the field to Expression mode, and copy them as they are written.

Four kinds of red text, and what each one means

Red text in an expression field, or a red border around it, is nothing to panic about. n8n tells you the reason right below the expression panel, and once you can read that message you can fix it in seconds. Four kinds cover almost everything.

flowchart LR
  A["The Result line is red,
or not the value you wanted"] --> B{"What does
it say?"}
  B -->|"undefined"| C["The field name is wrong.
Check the Schema view, or drag it in"]
  B -->|"Cannot read property"| D["The parent is empty. Use optional
chaining, or fix the upstream node"]
  B -->|"Referenced node does not exist"| E["Copy the node name off the
canvas, spaces and case included"]
  B -->|"a schema, no real values"| F["Click Execute step upstream
so it produces real output"]

Pitfalls that are not error messages

Some failures are quieter than a red border, and these are the ones that waste an afternoon.

The full variable list, for when you meet one in the wild

Seeing $json, $node and $input mixed in somebody else's workflow is confusing, but the logic is simple. They differ on whose data you are taking, and on whether you take one item or all of them.

Three common accessors go with the node forms: $('NodeName').first() and $('NodeName').last() take one item from the head or the tail, and $('NodeName').all() takes the whole array. Alongside them, $('NodeName').item takes the item matching the current iteration, aligned through pairedItem as Part 7 explained.

Questions people ask once and then stop asking

Where to go from here