n8n Security

n8n workflows handle sensitive business data — customer records, financial information, API credentials, internal communications. Securing your n8n deployment is not optional; a misconfigured n8n instance can expose all of this data. This guide covers the essential security practices for both self-hosted and cloud n8n deployments.

MJK Supplies · Dec 26, 2025 · 4 min read

ShareX in f ↗

Authentication and Access Control

Enable authentication immediately: On self-hosted n8n, authentication is not enabled by default in development mode. Before deploying to production, enable one of:

Basic Auth: Username and password. Simple, sufficient for small teams. Set with environment variables: N8N_BASIC_AUTH_ACTIVE=true, N8N_BASIC_AUTH_USER=admin, N8N_BASIC_AUTH_PASSWORD=strong-password.

Enterprise SSO: For larger teams, SAML-based SSO integrates n8n with your existing identity management (Okta, Azure AD, Google Workspace). Available on n8n Enterprise.

Role-based access: n8n supports user roles (owner, admin, member, viewer). Assign the minimum necessary permissions. A team member who only monitors workflows doesn't need admin access.

Change default passwords: The default admin credentials (if any) should be changed immediately on first access.

Credential Security

Never put credentials in workflows directly: Store all API keys in n8n's credential manager. Workflows reference credentials by name, not by value. This means:

Credentials are encrypted in the database
Exported workflow JSON doesn't include credential values
Multiple workflows can share one credential securely

Rotate credentials regularly: API keys are long-lived secrets. Establish a credential rotation schedule — rotate important credentials (production API keys, database passwords) at least quarterly.

Principle of least privilege: API credentials should have only the permissions they need. A read-only CRM integration doesn't need CRM write permissions. Create API keys with appropriate scope restrictions where the service supports it.

Audit credential access: Periodically review which workflows use which credentials. Remove credentials no longer in use.

Webhook Security

Webhooks expose HTTP endpoints that receive data from external services. Secure them:

Signature verification: Most webhook sources (Stripe, HubSpot, GitHub) include a cryptographic signature in the headers. Verify this signature in a Code node before processing:

const crypto = require('crypto'); const signature = $request.headers['x-stripe-signature']; const payload = $request.rawBody; const secret = 'your-webhook-secret'; const expectedSignature = crypto .createHmac('sha256', secret) .update(payload) .digest('hex'); if (signature !== `sha256=${expectedSignature}`) { throw new Error('Invalid webhook signature'); }

IP allowlisting: For self-hosted n8n, configure your firewall to only accept webhook traffic from the sending service's known IP ranges.

Token-based verification: For services without built-in signature verification, include a secret token in the webhook URL (/webhook/my-workflow?token=secret) and verify it in the workflow.

Network Security for Self-Hosted

Use HTTPS only: Never run n8n over plain HTTP in production. Use a reverse proxy (Nginx, Caddy, Traefik) with valid SSL certificates. Caddy provides automatic HTTPS with Let's Encrypt.

Don't expose n8n directly to the internet: Put n8n behind a reverse proxy. The reverse proxy handles SSL termination, rate limiting, and serves as a security boundary.

Firewall configuration: On your VPS:

Allow only ports 80 (HTTP, for redirect to HTTPS) and 443 (HTTPS) from the internet
Block direct access to port 5678 (n8n's default port) from the internet
Allow port 5678 only from the reverse proxy
Block all other inbound connections

Database security: If using an external PostgreSQL database, configure it to only accept connections from the n8n server's IP address.

Data Privacy

Execution data retention: n8n stores execution data (workflow inputs and outputs) for debugging. This data may contain sensitive customer information. Configure retention limits:

EXECUTIONS_DATA_SAVE_ON_SUCCESS=none — don't save successful execution data (use with caution — limits debugging)
EXECUTIONS_DATA_PRUNE_MAX_COUNT=1000 — keep only the last 1,000 executions

Sensitive data in logs: Be careful what data you pass through workflows that log to n8n's execution history. For PII-sensitive workflows, consider hashing or masking sensitive data in workflow outputs.

n8n Cloud privacy: n8n Cloud stores execution data on n8n's infrastructure. Review n8n's data processing agreement for GDPR and data residency considerations.

Recommended Tools

n8n — Platform with credential manager and access controls
Caddy — Reverse proxy with automatic HTTPS for self-hosted n8n
Cloudflare — Additional layer for DDoS protection and rate limiting
1Password or Bitwarden — Secure storage for the master n8n admin password
Fail2ban — Intrusion prevention for self-hosted servers

“A secure n8n deployment is not an afterthought — it's a prerequisite for processing real customer data. Address these security measures before any production workflow handles sensitive data.”