Securing Workflows & API Keys · Interactive Explainer

Core Principle 1

Never Hardcode Secrets in Workflows

Hardcoding a password or API key directly inside an n8n node or Make webhook is like gluing your house key to the front door. Anyone who exports the workflow JSON or views execution history sees it in plaintext.

          ✓ DO: Reference credentials via environment variables ($ENV) or credential vault.

          ✗ DON'T: Paste "sk-live-xyz..." into the HTTP Request node body.

Core Principle 2

Zero-Downtime Dual-Key Rotation

When replacing an old key, don't just delete it. Services support two active keys simultaneously: generate Key B, update your workflow credentials, verify production runs successfully, and only then revoke Key A.

          Step 1: Create Key B (Standby)

          Step 2: Switch Workflow to Key B

          Step 3: Decommission Key A

Core Principle 3

AI Agent Least-Privilege Scoping

When building AI agent workflows, never hand the LLM your master database admin key. Issue dedicated, scoped sub-keys that can only perform the exact action needed (e.g. read-only, or 10 requests/min rate limit).

          ✓ Granular Scope: "read:orders"

          ✗ Unrestricted Scope: "admin:*"

🛡️ Production Workflow Checklist (n8n & Make)

✅
Execution Data Pruning Enable automatic log pruning in n8n (EXECUTIONS_DATA_PRUNE=true) to ensure customer payloads and Authorization headers don't sit in local SQLite/Postgres databases forever.
✅
Webhook Authentication Never leave incoming workflow webhooks unauthenticated. Always enforce a shared secret header (e.g. X-Webhook-Token) or HMAC signature validation before processing the payload.
✅
AI Agent Prompt Injection Shielding Treat untrusted incoming messages (like emails or WhatsApp chat) as untrusted data inputs. Never pass raw user prompts directly into database query nodes without input sanitization.