Skip to content

Automations

Hand over API keys for n8n, Zapier or Make

Short answer

Ask the key’s owner to send it as an Argoned sealed link (an encrypted link that opens once, with a separate access code), then paste the key straight into the platform’s own credential store. Never put it in workflow steps, notes or prompts.

The platforms protect what you save there: n8n encrypts saved credentials with an instance key, and Zapier stores app connections encrypted and uses OAuth for many apps.

By Argoned Last reviewed

Connected services passing tasks between them

Keep out

Where API keys should not go in a workflow

Workflows are copied, exported and shared, so a key typed into any of these places travels along with them.
  • Inside a workflow step, such as an HTTP request header typed by hand, a Code node or a “Set” field.
  • Inside an AI agent node’s prompt or system message.
  • In sticky notes, descriptions or workflow names.
  • In exported workflow files that you share or commit.

Handover

How to hand over an API key, step by step

Four steps for getting a client’s key into your automation platform without it passing through chat or email.
A phone sharing a link

  1. Ask for a scoped key

    Ask the key owner for a scoped key: one limited to what the workflow needs.

  2. Receive it sealed

    They send it as an Argoned sealed link and give you the access code another way, such as a phone call.

  3. Store it in the platform

    Open the link in your browser, type the access code and paste the key into n8n, Zapier or Make as a saved credential or connection.

  4. Plan to replace it

    Note who owns the key and when to replace (rotate) it. When the project ends, ask the owner to revoke it.

n8n

Storing API keys in n8n

n8n keeps saved credentials encrypted, as long as you look after the instance key that protects them.
A shield in front of servers
  • n8n encrypts saved credentials with an encryption key for the instance. If you host n8n yourself, set the N8N_ENCRYPTION_KEY environment variable (a setting n8n reads when it starts) explicitly and back it up; without it, saved credentials cannot be decrypted.
  • On plans that support it, you can share a credential with another user so they can use it in workflows without seeing its value.
  • Where the app offers OAuth, which lets you sign in to the app instead of pasting a key, use it. Give API keys the smallest scope that works.

Zapier

Storing API keys in Zapier

In Zapier, keys belong in app connections, set up once and kept out of the steps of each Zap.
  • Zapier stores app connections encrypted, and many apps connect with OAuth so you never handle a key.
  • When an app asks for an API key, add it as a connection, not inside a step.
  • Review who in your account can use each connection.

Make

Storing API keys in Make

In Make, keys and tokens belong in a connection, set up once and reused by the modules that need it.
  • Add API keys and tokens as a connection when you set up a module, not as text in a module field or a scenario note.
  • Use the app’s sign-in (OAuth) connection where Make offers one.
  • Check who in your organisation can use each connection before sharing a scenario.

Agent nodes

AI agent nodes in workflows

AI agent nodes choose their own tools from the text they read, which changes how much access you should give.
An AI agent working on a screen

Agent nodes decide which tools to call based on text, including text from emails, web pages and documents the workflow reads. That text can carry hidden instructions meant to redirect the agent, known as prompt injection. Give the tools they call narrowly scoped credentials, and keep high-risk actions, such as payments or deleting data, behind a human approval step.

Argoned

Where Argoned fits

Argoned is there for the handover only. From then on, the automation platform looks after the credential.

Argoned does not connect to n8n, Zapier or Make and cannot put credentials into workflows. It gets the key to you sealed, once. Scoping, replacing and revoking the key stay with you and the key’s owner.

FAQ

Questions

Short answers about keys in n8n Code nodes, losing a self-hosted encryption key, agent nodes and sending keys into workflows.
Two people beside a large question mark
Can I put an API key in an n8n Code node?

Avoid it. Save the key as a credential so it is encrypted and kept out of the workflow itself and its exports.

What happens if I lose my self-hosted n8n encryption key?

Saved credentials cannot be decrypted without it. Back the key up somewhere safe, separate from the server.

Can an AI agent node see my credentials?

It calls tools that use saved credentials, so keep keys out of its prompts, where the model would read them. Give each tool only the scope it needs, because the agent can do whatever its tools allow.

Can Argoned send credentials straight into a workflow?

No. A person opens the sealed link in a browser, then saves the credential in the platform.

Sources

A person beside a locked laptop

Your agent needs a login. Send it sealed.

Seal a login or API key in your browser and send a link instead of the password.

Create a free vault All AI agent guides

£0 · Free plan, no card needed · Encrypted in your browser