I’m currently using n8n Pro, and I’m trying to understand the best practice for managing credentials between DEV and PROD environments.
I have a workflow built in DEV with multiple nodes configured using development credentials, for example:
OpenAI
ERPNext
other external services
When the workflow is ready, I duplicate it to move it to production.
The issue is that I then have to manually open many nodes and replace the DEV credentials with the PROD credentials.
I’m wondering whether there is a better approach in n8n, such as:
dynamically using different credentials depending on the environment
avoiding manual credential replacement node by node
having a cleaner deployment process from development to production
So my main question is:
Is there a way in n8n to configure a workflow so that it automatically uses the correct credentials for DEV or PROD, without manually changing the credentials in every node after duplicating the workflow?
I’d also like to understand what the recommended best practices are in this scenario. For example:
duplicating the workflow and manually changing credentials
using separate DEV/PROD instances
using environment variables
following a naming convention for credentials
or any other cleaner strategy
If anyone has already solved this in a structured way, I’d really appreciate an example of how you organize it.
I’d usually handle this with separate DEV and PROD instances, and keep the credential names the same in both. That way the workflow can move over much more cleanly, without opening every node to swap credentials.
Hi @Gianluca having different instances is a bit unusual, people just separate workflows based on “CRM Staging” & “CRM Prod” and that is really it, having different cloud instances just to keep things separated is not a bad idea but sounds like a too much work, why dont you try just having a single instance but a folder named Prod containing all published and in production flows and externally just keep all the flows you are working on, so that would cut off another n8n instance overhead and also a lot of copy pasting time, and in case if you really want this setup i recommend having your production n8n instance self hosted, so that you can do a lot of customization related to credentials as on cloud there is almost nothing related to env variables.
Just to make sure I understood correctly: do you mean having separate DEV and PROD instances (or projects), each with its own credentials but using the same credential names, and then maintaining two copies of the workflow, one in DEV and one in PROD?
happy to help!
I hope everything goes well.
If this solution solves your problem, please consider liking or marking the answer as the solution (this helps others find the answer more easily and also supports community contributors).
I agree that keeping separate DEV and PROD instances, with the same credential names in both environments, is the cleanest approach for moving workflows between environments.
However, I’m attaching a screenshot that shows the issue I’m still facing: even when the credential names match, after importing/moving the workflow I still need to open each individual node and refresh/reselect the credential manually before the workflow is fully usable.
So yes, the approach works, but in practice it still requires opening every node that uses credentials, which becomes quite time-consuming on larger workflows.
Is there a better way to force n8n to remap or refresh credentials automatically across the imported workflow, assuming the credential names are identical in DEV and PROD?
I’d avoid manual imports when credentials are involved and use source control for DEV, staging, and PROD instead. Just keep in mind that source control does not copy credential secrets, so each environment still needs its own credentials set up. I’d keep the credential names consistent, create the PROD credentials before the import, and do one controlled remap in staging before touching production. For self-hosted setups at scale, I’d look at using the n8n API or CLI to inspect and adjust workflow credential references instead of opening every node by hand.
One approach that works well if you’re on self-hosted: use n8n’s built-in $env variable in expressions to pull environment-specific config, then store your API keys as environment variables (e.g., OPENAI_API_KEY_PROD, OPENAI_API_KEY_DEV) and reference them in a Set node at the start of the workflow. The credential itself stays generic - only the HTTP Request node or a custom auth header changes based on $env.ENVIRONMENT.
For cloud where $env isn’t available, the cleanest approach is what tamy.santos mentioned - same credential names across instances. Name them exactly OpenAI Production, OpenAI Development, keep the names identical on each instance, and workflows import without touching a single node.
