Assign every automation credential a business owner, an operational custodian and a review date. Store references and responsibilities in the register, never the secret values themselves.
Distinguish credentials from their owners
n8n documents credentials as securely stored authentication information used to connect workflows to external services such as APIs or databases. On saving, n8n tests a credential; credentials may be created in a personal space or project where supported.
Those facts describe authentication handling, not your organisation's ownership arrangements. A successful credential test does not answer who approved the connection, who pays for the external service or who handles a failed business process.
The register below is editorial advice for making those responsibilities explicit without duplicating sensitive material.
Record responsibility without secrets
Create one entry per credential reference with these fields:
- Reference and service: A recognisable internal label and the connected service category.
- Business purpose: The specific process that needs authentication.
- Service owner: The person authorised to decide whether that connection should exist.
- Custodian and backup: People responsible for operational coordination.
- Identity type: Whether the underlying account is organisational or personally held, where verified.
- Scope location: Personal space or project, if applicable and confirmed.
- Dependencies: References to processes that rely on the credential.
- Evidence and review: Last confirmed test outcome, outstanding questions and next review date.
Exclude passwords, API keys, tokens, recovery codes and private service responses. Also avoid account labels that reveal unnecessary personal information.
Evaluate a hypothetical register entry
Consider a hypothetical Indore distributor using a synthetic inventory demonstration. Its register contains “Inventory-demo-read”, with the operations lead as service owner, an automation specialist as custodian and a second operator as backup.
The business purpose is narrowly stated: retrieve fabricated stock counts for a daily internal demonstration. The review date is 15 November 2026, and the dependent process reference is “DEMO-STOCK-01”.
Evaluate the entry by asking whether the backup can identify who may approve a change and which process needs checking afterwards. If the answer depends on finding the original developer, the register is incomplete even if the saved credential passes its test.
Stop ownerless connections from becoming permanent
Stop expanding use of a credential whose business owner or underlying identity is unknown. Next, resolve ownership and confirm its intended purpose before adding dependencies. Do not solve a missing custodian by copying a secret into a team document.
If you are comparing paid access for the operating team, browse the AI tools catalog, check access format and save terms before buying. Marketplace account, code or token offers are not proof of official subscription equivalence or ownership of connected services.
Sources and scope
Source material checked 29 October 2026; features/policies may change. n8n credential documentation establishes credential purpose, saving tests and supported creation locations. The register, example and ownership decisions are editorial advice.