I’m about to approach my first client to set up an n8n workflow that connects to their Google Calendar, Gmail, Google Drive, and Airtable. The problem I’m running into is that I need access to their accounts to set everything up but I’m a stranger to them. Asking for their passwords feels like a huge trust barrier, especially for a small business owner who has their entire business tied to their Google account.
A few questions:
How do you actually get access without asking for passwords? Is OAuth or Google Workspace sharing the standard approach?
Have you had clients who refused to give any access at all and how did you handle it?
Is there a way to structure the setup so the client does the credential connecting themselves while you guide them, keeping passwords entirely on their side? Any practical advice from people who have actually delivered this to non-technical clients would be really helpful.
@andrej_vlaovic oauth is built exactly for this, you never touch their passwords. they hit “sign in with google” on the n8n credential and authorize on googles own page, so the password stays with google and n8n only gets a revocable token. for non-technical clients just screen-share, you drive n8n and they do the single consent click. airtable same deal, have them create a personal access token scoped to just the bases you need rather than share the account. if someone refuses outright, build against your own dummy accounts and have them connect their own creds at the very end.
Great question, and your instinct is right — never ask a client for their password. OAuth (the client authorizes access on their own side) is exactly the standard. Here’s how I’d structure it:
Get access without passwords — let the CLIENT connect their own credentials.
The cleanest setup: build the workflows inside an n8n instance the client owns (their n8n Cloud or self-hosted) and have them invite you as an editor/member. They click “Sign in with Google” on Google’s own consent screen and approve the scopes — the token stays on their side, you never touch a password. Same for Airtable: they generate a Personal Access Token scoped to just the bases you need and paste that in. You build; they own the keys.
If they don’t have their own n8n yet, the next best thing is a quick screen-share call where you guide them click-by-click through connecting each credential. They press every “Allow” button themselves. 15 minutes, and the trust barrier disappears.
For Google specifically — two solid options:
Google OAuth2: the client signs in through Google’s consent screen and approves scopes (Calendar/Gmail/Drive). Fully revocable from their Google account → Security → Third-party access, anytime.
For Workspace clients who want IT control: an admin sets up a service account with domain-wide delegation, or creates a dedicated “automations@company” account shared into only the relevant Calendar/Drive. Scoped, auditable, no personal passwords. A separate automation account also keeps the blast radius small.
Clients who refuse ANY access:
Deliver the workflow as an exported JSON plus a short walkthrough showing them how to import it and connect their own credentials. They run the whole thing on their side — you never log into their accounts. For non-technical owners, a paid 30-minute guided setup call works great: they keep full control, you get paid for the handholding.
The one line that dissolves the trust barrier: tell them up front — “You’ll connect your own accounts through Google’s secure login. I never see or store your passwords, and you can revoke my access in one click anytime.” Say it early and most owners relax immediately.
Bottom line: scoped, client-owned, revocable credentials — built in their instance or guided on a call. Passwords stay on their side, always.
The setup can be client-owned without being client-abandoned.
I’d use a tiny handoff checklist: client owns the n8n workspace, connects Google/Airtable on-screen, you document scopes used, test action, revoke path, and what audit trail proves after the first run. That usually builds more trust than asking for access.
Welcome to the community! First off, your instinct is 100% correct—never ask a client for their raw passwords. It is a massive liability for you and a major security risk for them.
As an AI Automation Engineer who builds these pipelines regularly, I can tell you that framing this correctly during onboarding actually builds trust rather than breaking it. Here is how you can handle this cleanly and professionally using n8n:
1. The Standard: Scoped, Password-Free Access
The entire modern API ecosystem is built to avoid sharing passwords. You should rely on modern authorization frameworks:
Google OAuth 2.0: For Gmail, Calendar, and Drive, n8n utilizes native OAuth. When configuring the credential, you (or the client) click “Sign in with Google.” This redirects them to Google’s secure login window. They authorize the request, and Google passes a secure, revocable token back to n8n. You never see a password.
Airtable Personal Access Tokens (PATs): Instead of account sharing, have the client generate a PAT from their developer settings. Crucially, they can scope this token so it only has access to the specific workspace or base you are building for, keeping the rest of their data completely private.
2. Handling High-Security or Risk-Averse Clients
If a client completely refuses to grant access to their production environments during development, pivot to a Sandbox Framework:
Build with Dummy Accounts: Connect the n8n nodes to your own staging/test Google and Airtable accounts. Build out the full logic, error handling, and data mapping using dummy data structures that mimic theirs perfectly.
The “Plug-and-Play” Export: Once fully tested, you can simply export the workflow as a JSON file or give them access to the canvas.
3. Structuring a Seamless Setup Session
For non-technical small business owners, the best way to dissolve the trust barrier is a Guided Co-Working deployment call.
Phase 1 (Prep): Send them a quick 60-second Loom video showing them exactly where to generate their Airtable PAT.
Phase 2 (The Live Call): Schedule a 30-minute screen-share. You drive the workflow canvas and the logic. When it’s time to link the accounts, pass presentation control to them. They click the “Sign in with Google” button, hit “Allow” on their own browser, and the credential securely saves inside their instance.
To protect your business security, our agency protocol dictates that we never touch or see your personal passwords. We handle the heavy lifting of the automation logic, and you safely approve the connection directly through Google’s secure portal. By shifting the narrative, you turn a potential security hurdle into a showcase of your professionalism.
Hope this helps you land your first client successfully! Let me know if you run into any mapping issues.