I’m setting up workflows for a few different users. How do I set up credentials for each of them without having to get their personal accounts, or can they just create them themselves?
If you are using a version of n8n with User Management enabled (available in n8n Cloud and most self-hosted installations), the process is straightforward:
- Invite Users: You invite the users to your n8n instance via email.
- Private Credentials: Once they log in, any credential they create is private to them by default.
- Workflow Execution: When you build a workflow for them, you can leave the credential field empty or set it to a placeholder. When the user opens the workflow, they simply select their own pre-configured credential from the dropdown menu.
For services that support OAuth2 (like Google, Slack, Microsoft, etc.), the user never has to give you their password:
- You set up the “App” (Client ID and Client Secret) in the service’s developer console.
- The user clicks the “Connect my account” button in n8n.
- They are redirected to the service’s own login page (e.g., Google’s login screen), where they authorize n8n.
- n8n receives a “token” to act on their behalf, but you never see their actual login credentials.
If you have created a “Service Account” (a generic account used by the company) and want multiple users to use it without knowing the password:
- You create the credential under your admin account.
- In the credential settings, you can share that specific credential with other users or specific roles.
- The users can then select that shared credential in their workflows, but they cannot see or edit the actual API key or password.
It depends on what kind of credential you’re setting up.
For shared services (a Slack bot, a database connection, an internal API, anything where one account serves the whole team): you can create the credential yourself, then open it and click the Sharing tab. There’s a dropdown to share with specific users or projects. They’ll be able to use it in workflows, but they won’t see the actual API key or secret. It stays locked to you as the owner.
For personal OAuth accounts (each person’s own Gmail, Google Drive, Notion, etc.): there’s no way around it. Each user needs to authenticate with their own account. You can’t do it for them without logging in as them. The good news is the process is the same for them as it would be for you: Credentials → Add Credential → pick the service → go through the OAuth flow. As long as they have an n8n account on your instance, they can do that themselves.
So practically: you set up shared service credentials and share them out, your team members create their own for anything tied to their personal accounts.
One small thing worth knowing: users you share credentials with can use the credential in workflows but can’t view or edit the underlying secret. If their token expires or breaks for some reason, either you re-share a fresh one or they need to reauthenticate themselves. Worth setting that expectation up front.