Managing different credentials for DEV and PROD workflows without manually updating every node

Hi everyone,

I’m currently using n8n Pro, and I’m trying to understand the best practice for managing credentials between DEV and PROD environments.

I have a workflow built in DEV with multiple nodes configured using development credentials, for example:

  • OpenAI

  • ERPNext

  • other external services

When the workflow is ready, I duplicate it to move it to production.
The issue is that I then have to manually open many nodes and replace the DEV credentials with the PROD credentials.

I’m wondering whether there is a better approach in n8n, such as:

  • dynamically using different credentials depending on the environment

  • avoiding manual credential replacement node by node

  • having a cleaner deployment process from development to production

So my main question is:

Is there a way in n8n to configure a workflow so that it automatically uses the correct credentials for DEV or PROD, without manually changing the credentials in every node after duplicating the workflow?

I’d also like to understand what the recommended best practices are in this scenario. For example:

  • duplicating the workflow and manually changing credentials

  • using separate DEV/PROD instances

  • using environment variables

  • following a naming convention for credentials

  • or any other cleaner strategy

If anyone has already solved this in a structured way, I’d really appreciate an example of how you organize it.

Thanks!

@Gianluca

I’d usually handle this with separate DEV and PROD instances, and keep the credential names the same in both. That way the workflow can move over much more cleanly, without opening every node to swap credentials.

Hi @Gianluca having different instances is a bit unusual, people just separate workflows based on “CRM Staging” & “CRM Prod” and that is really it, having different cloud instances just to keep things separated is not a bad idea but sounds like a too much work, why dont you try just having a single instance but a folder named Prod containing all published and in production flows and externally just keep all the flows you are working on, so that would cut off another n8n instance overhead and also a lot of copy pasting time, and in case if you really want this setup i recommend having your production n8n instance self hosted, so that you can do a lot of customization related to credentials as on cloud there is almost nothing related to env variables.

Just to make sure I understood correctly: do you mean having separate DEV and PROD instances (or projects), each with its own credentials but using the same credential names, and then maintaining two copies of the workflow, one in DEV and one in PROD?

yes, correct

it’s common practice in some places to develop in one environment and run production workflows in another.

thanks for your help ! I’ll try ASAP

happy to help!
I hope everything goes well.
If this solution solves your problem, please consider liking or marking the answer as the solution (this helps others find the answer more easily and also supports community contributors).

你好,

感謝你的建議。

我同意在 DEV 和 PROD 環境中保持獨立的實例,並使用相同的認證名稱,這是在環境之間移動工作流程最乾淨的方法。

不過,我附加了一個截圖,顯示我仍然面臨的問題:即使認證名稱相符,在匯入/移動工作流程後,我仍然需要打開每個節點並手動重新整理/重新選擇認證,才能讓工作流程完全可用。

所以是的,這個方法有效,但在實踐中仍然需要打開每個使用認證的節點,這在較大的工作流程上變得相當耗時。

有沒有更好的方法來強制 n8n 在匯入的工作流程中自動重新對應或重新整理認證,假設認證名稱在 DEV 和 PROD 中相同?

謝謝。

@Gianluca

當涉及認證資訊時,我建議避免手動匯入,改為針對 DEV、staging 和 PROD 使用原始碼控制。不過要記住,原始碼控制不會複製認證密鑰,所以每個環境仍需要自己設定認證資訊。我會保持認證名稱一致,在匯入前建立 PROD 認證,並在接觸生產環境前先在 staging 進行一次受控的重新映射。對於大規模的自託管設定,我建議使用 n8n API 或 CLI 來檢查和調整工作流程認證參考,而不是逐個手動開啟每個節點。

一個在自架伺服器上運作良好的做法是:在表達式中使用 n8n 的內建 $env 變數來提取特定環境的設定,然後將你的 API 密鑰儲存為環境變數(例如 OPENAI_API_KEY_PRODOPENAI_API_KEY_DEV),並在工作流程開始的設定節點中引用它們。認證本身保持通用 - 只有 HTTP 要求節點或自訂驗證標頭會根據 $env.ENVIRONMENT 改變。

對於無法使用 $env 的雲端環境,最簡潔的做法是 tamy.santos 提到的方式 - 在各個實例中使用相同的認證名稱。將它們確切命名為 OpenAI ProductionOpenAI Development,在每個實例上保持名稱完全相同,工作流程匯入時無需觸及任何節點。

@Gianluca 我做了一個工具可以自動化這個流程;如果你想測試的話就跟我說一聲