Every app node - Slack, Gmail, Airtable, Notion, whatever - needs permission to act on your behalf. n8n handles this through a separate, reusable object called a credential, kept deliberately apart from the workflow itself.
Why credentials are separate from workflows
If your API key or OAuth token lived inside the workflow, every workflow using the same Slack account would need its own copy - and revoking access would mean hunting through every workflow individually. Instead, you create one Slack credential, and any node in any workflow can select it from a dropdown. Revoke or update it once, and every workflow using it is affected immediately.
The two connection types you'll hit most
API keys are the simpler case: paste a token from the target app's settings page into n8n's credential form. Common for tools like Airtable, OpenAI, and most developer-facing APIs.
OAuth is what you'll see for apps like Google, Slack, and Notion - clicking "Connect" opens that app's own login screen, you approve access, and n8n stores the resulting token behind the scenes. You never see or handle the raw token yourself, which is both more secure and less error-prone than copy-pasting keys.
Where credentials actually live
n8n encrypts credential data at rest, and by default, only the person who created a credential (or an admin, depending on your instance's permission settings) can see or edit it - other users can select it in a node without ever viewing the underlying key. On n8n Cloud and in team/enterprise setups, credentials can be shared with specific users or projects without exposing the raw value.
Testing a credential before you build around it
Most credential forms have a "Test" or "Connect" button right in the setup dialog - use it before wiring up an entire workflow around a connection you haven't verified. It's a thirty-second check that saves you from debugging "why is my workflow failing" only to discover the actual issue was an expired token three steps upstream.
Rotating and revoking
When a token expires or you need to rotate a key for security reasons, you update it in one place - the credential itself - rather than touching every workflow that uses it. This is the entire point of keeping credentials separate, and it's worth deliberately using shared credentials rather than pasting the same API key into five different HTTP Request nodes.