Credentials: connecting your accounts

Before a Gmail node can send email from your account, n8n needs permission. That permission is stored as a credential: saved login details for one service.

You can create a credential from the node itself (the "Credential to connect with" dropdown) or from the Credentials list. Depending on the service, you either:

• Sign in with OAuth: a window from the service (for example Google) asks you to allow n8n access. n8n never sees your password; it receives a permission token instead.
• Paste an API key: a long secret code from the service's settings page. Treat it like a password.
• Enter a username and password, or other details such as a database address.

n8n tests a credential when you save it and tells you if it works. Rename it to say what it is for, such as "Gmail - support inbox".

How n8n protects credentials:

• They are stored encrypted (scrambled so they're unreadable without a secret key). Self-hosters must keep that key safe, as the hosting lessons explain.
• When you share or export a workflow, the credentials themselves are not included, only a reference to them.
• Many credentials have an Allowed HTTP Request Domains setting that limits which web addresses they may be sent to.

On n8n Cloud, some AI model nodes can run without your own credential by using n8n's built-in credits.

In teams, credentials live in projects or your personal space, and can be shared with colleagues without revealing the secret values.