Connecting Credentials in n8n: Google, Slack, OAuth

What credentials are

In n8n, a credential is a saved, encrypted login for an app. You create it once and reuse it in every workflow. Credentials are stored encrypted with your instance's encryption key, and on paid plans they can be shared with teammates without revealing the secret.

There are three common types:

• API key / token: paste a key from the app's settings (OpenAI, Airtable personal access token, Stripe secret key).
• OAuth2: you click "Sign in with…" and approve access (Google, Slack, Microsoft, HubSpot).
• Basic auth / header auth: for webhooks and simple APIs.

Before you start: the OAuth redirect URL

Every OAuth2 credential in n8n shows an OAuth Redirect URL, such as https://n8n.yourcompany.com/rest/oauth2-credential/callback. You paste this into the app's developer console. It must match exactly, including https.

On n8n Cloud, many apps (Google, Slack, Microsoft) offer a one-click Sign in button with no developer setup. On self-hosted n8n, you usually create your own OAuth app first.

Google (Sheets, Gmail, Drive, Calendar)

On self-hosted n8n:

1. Open the Google Cloud Console and create a project.
2. Go to APIs & Services → Library and enable the APIs you need, such as Google Sheets API, Gmail API and Google Drive API.
3. Configure the OAuth consent screen. Choose Internal if you use Google Workspace and only your org will connect; otherwise External, and add yourself as a test user.
4. Go to Credentials → Create credentials → OAuth client ID, type Web application.
5. Paste n8n's OAuth Redirect URL into Authorized redirect URIs.
6. Copy the Client ID and Client Secret into the n8n credential (Google OAuth2 API or the app-specific one) and click Sign in with Google.

Tip: an External app in "Testing" status issues tokens that expire after 7 days. Publish the app (or use Internal) for long-running workflows.

Slack

1. Go to api.slack.com/apps and click Create New App → From scratch.
2. Under OAuth & Permissions, add the redirect URL from n8n.
3. Add the scopes you need. For posting messages: chat:write; to read channels: channels:read, channels:history.
4. Copy the Client ID and Client Secret into n8n's Slack OAuth2 credential and connect.
5. Invite the app to any channel it should post in (/invite @YourApp).

For a single workspace, a Bot token (starts with xoxb-) with the Slack API credential is simpler than OAuth.

Microsoft (Outlook, Teams, OneDrive)

1. In the Azure portal, open App registrations → New registration.
2. Add n8n's redirect URL as a Web redirect URI.
3. Under Certificates & secrets, create a client secret.
4. Under API permissions, add Microsoft Graph delegated permissions such as Mail.ReadWrite, Mail.Send and offline_access.
5. Paste the Application (client) ID and secret into n8n's Microsoft OAuth2 credential.

Generic OAuth2 for any app

If n8n has no dedicated credential, use OAuth2 API with the HTTP Request node. You need the app's authorization URL, access token URL, client ID, client secret and scopes from its developer docs.

Security checklist

• Give each credential the smallest scopes it needs.
• Use a dedicated service account or bot user, not a person's account, for business-critical workflows.
• Store N8N_ENCRYPTION_KEY safely; losing it means re-creating every credential.
• Rotate secrets when someone leaves the team.

Why this matters for migration

When you move from Zapier or Make, workflows can be rebuilt from exports, but credentials cannot be transferred. Re-creating them is usually the slowest part of a migration, so set them up first. See the Zapier to n8n migration guide.