Skip to main content
For building directly against the API. If you only need to receive events, use webhooks instead — they are less work and less to secure.

​
Creating one

API Keys → Create API Key. Give it a name, choose scopes, and optionally an expiry.
The key is shown once, at creation. Copy it then. If you lose it, revoke it and create another — there is no way to display it again.

​
Scopes

Grant only what the integration needs: A read-only integration should hold only the :read scopes. A leaked read key is an incident; a leaked write key is a much bigger one.

​
Naming

Name for where it is used, not what it does — “n8n production”, “warehouse sync”, “staging tests”. When you need to revoke one in a hurry, that is the information you need, and “API key 3” tells you nothing about what will break.

​
Revoking

Revoking is immediate and permanent. The list shows status, scopes, prefix, creation date and last used — that last column is how you find keys nobody needs any more. A key that has never been used, or has not been used in months, is almost always safe to revoke. Do it: unused credentials are pure risk.

​
Expiry

Setting an expiry means a forgotten key stops working on its own rather than living forever. Worth using for anything temporary — a contractor’s integration, a one-off migration, a proof of concept.

​
Developer documentation

Endpoints, authentication and payloads are in the developer guides.