N8n oauth config

Questions
1

What’s the simplest way to manage OAuth credentials for Gmail, LinkedIn, Reddit, etc. in n8n setting up all these tokens and API keys for every service is getting tedious. Is there a streamlined approach to configuring them, and where is the recommended place to store these credentials, in a .env file, or can everything be handled directly through the n8n UI?

2

All your credentials live in the Credentials tab inside n8n @Sturdy no need to scatter tokens across .env files. n8n encrypts everything in its own database, so your .env should only contain n8n’s own configuration variables. If you’re self-hosting, one critical thing: back up your N8N_ENCRYPTION_KEY somewhere safe. Lose it and your stored credentials are completely unrecoverable.

The setup pain is mostly a one-time cost per service:

Gmail: Create a Google Cloud project, enable the Gmail API, configure the OAuth consent screen, and create an OAuth client. Paste the callback URL n8n provides. The part that trips everyone up: publish your consent screen to Production, not just Testing. If you leave it in Testing mode, Google invalidates your refresh token every 7 days and you’ll be reconnecting constantly. The same client can be reused later for Google Sheets and Drive.

Reddit: Straightforward. Just register a quick app from your Reddit preferences page.

LinkedIn: The most frustrating one. Their official API is heavily restricted and barely allows anything beyond basic posting.

Once set up, n8n won’t ask you to re-authenticate every time you use those nodes. That said, tokens do occasionally get refreshed or expire, so it’s worth saving your API keys and secrets in a password manager or secure notes app, you’ll thank yourself later.

3

The simplest approach is to let n8n manage the OAuth flow for you through the Credentials UI rather than manually creating and storing access tokens in .env files.

Recommended Approach (Best Practice)

For services like Gmail, LinkedIn, Reddit, Slack, Notion, Google Drive, etc.:

  1. Go to Credentials in n8n.
  2. Create a new credential for the service.
  3. Enter the required Client ID and Client Secret (obtained from the provider’s developer portal).
  4. Click Connect or Sign In.
  5. Complete the OAuth authorization flow.

n8n will:

  • Store the access token and refresh token securely.
  • Automatically refresh expired tokens when supported.
  • Reuse the same credential across multiple workflows.

This is the standard and most maintainable setup.

When to Use .env Variables

Use .env variables only for:

  • API keys
  • Client IDs
  • Client Secrets
  • Shared configuration values
  • Self-hosted deployment settings

Example:



GOOGLE_CLIENT_ID=xxxxx
GOOGLE_CLIENT_SECRET=xxxxx
REDDIT_CLIENT_ID=xxxxx
REDDIT_CLIENT_SECRET=xxxxx

You can then reference them inside n8n credentials using expressions:



{{$env.GOOGLE_CLIENT_ID}}
{{$env.GOOGLE_CLIENT_SECRET}}

This keeps secrets out of the UI and makes migrations between environments easier.

For Multiple Services

Unfortunately, there is no single “master OAuth” configuration that automatically handles Gmail, LinkedIn, Reddit, and every other provider. Each platform requires:

  • Its own developer app
  • Its own Client ID
  • Its own Client Secret
  • Its own OAuth consent

The good news is that you typically only configure each service once, and then reuse that credential across all workflows.

If You’re Self-Hosting

A common production setup is:

  • Store Client IDs and Client Secrets in .env or a secret manager.
  • Create credentials in n8n that reference those environment variables.
  • Let n8n handle the actual OAuth tokens and refresh cycles.

This gives you:

  • Better security
  • Easier backups
  • Easier server migrations
  • Centralized credential management

So in short: Use the n8n Credentials UI for OAuth tokens and authorization, and optionally store Client IDs/Secrets in .env if you’re self-hosting and want cleaner secret management. This is the approach most experienced n8n users follow.