n8n Support Options Compared: What Each Channel Actually Guarantees (2026)

export N8N_API_KEY='n8n_api_...'
node n8n-bus-factor-audit.mjs --url https://n8n.example.com --stale-days 90

export N8N_ENCRYPTION_KEY='...'
node n8n-bus-factor-audit.mjs \
  --url https://n8n.example.com \
  --key-backup /secure/n8n-encryption-key.txt \
  --fail-under 80

n8n bus-factor audit  https://n8n.example.com
2 workflows (2 active), 2 credentials
------------------------------------------------------------------------
SCORE: 56/100
------------------------------------------------------------------------
Encryption key not provably backed up                1     -30
Active workflow with no error workflow               1     -3
HTTP Request node with a pasted secret               1     -8
Single-owner credential used by an active workflow   1     -2
Active workflow untouched in 90+ days                1     -1

ENCRYPTION KEY
  ! N8N_ENCRYPTION_KEY is not set in this process. If it is not set for the n8n
    process either, n8n generated a random key into ~/.n8n/config on first boot.

ACTIVE WORKFLOWS WITH NO ERROR WORKFLOW (they fail silently)
  - Stripe to Sheets  [w1]

SECRETS PASTED INTO HTTP REQUEST NODES (not in a credential object)
  - Stripe to Sheets > HTTP Request  [w1]
      parameters.headerParameters.parameters.Authorization: secret-bearing header/query parameter set to a literal value

#!/usr/bin/env node
/**
 * n8n bus-factor audit. Scores how badly a broken n8n instance would hurt you.
 * Node 18+, no dependencies. MIT licence. https://n8nlogic.com
 *
 *   export N8N_API_KEY='...'   # owner or admin key: GET /credentials is owner/admin-only
 *   node n8n-bus-factor-audit.mjs --url https://n8n.example.com
 *
 * Options: --stale-days <n> (default 90), --key-backup <path>, --fail-under <n>, --json
 */

import { readFileSync, statSync } from 'node:fs';

// --- args -------------------------------------------------------------------

const argv = process.argv.slice(2);
const arg = (name) => {
	const i = argv.indexOf(name);
	if (i === -1) return undefined;
	const value = argv[i + 1];
	if (value === undefined || value.startsWith('--')) {
		throw new Error(`Option ${name} requires a value.`);
	}
	return value;
};

const BASE_URL = (arg('--url') ?? '').replace(/\/+$/, '');
const STALE_DAYS = Number(arg('--stale-days') ?? 90);
const KEY_BACKUP = arg('--key-backup');
const FAIL_UNDER = arg('--fail-under') === undefined ? null : Number(arg('--fail-under'));
const JSON_OUT = argv.includes('--json');
const API_KEY = process.env.N8N_API_KEY;

if (!BASE_URL) throw new Error('Missing --url. Example: --url https://n8n.example.com');
if (!API_KEY) throw new Error('Missing N8N_API_KEY. Create one in n8n: Settings > n8n API.');
if (!Number.isFinite(STALE_DAYS) || STALE_DAYS <= 0) throw new Error('--stale-days must be a positive number.');

// --- API --------------------------------------------------------------------

async function apiGet(path, params = {}) {
	const url = new URL(`${BASE_URL}/api/v1${path}`);
	for (const [k, v] of Object.entries(params)) url.searchParams.set(k, String(v));

	const res = await fetch(url, {
		headers: { 'X-N8N-API-KEY': API_KEY, accept: 'application/json' },
	});

	if (!res.ok) {
		const body = await res.text();
		throw new Error(
			`GET ${url.pathname} failed: ${res.status} ${res.statusText}. ${body.slice(0, 300)}\n` +
				(res.status === 401 || res.status === 403
					? 'This endpoint needs an instance owner or admin API key. Do not downgrade the key and rerun: ' +
						'a partial audit is worse than none, because it will look clean.'
					: ''),
		);
	}
	return res.json();
}

async function apiGetAll(path, params = {}) {
	const items = [];
	let cursor;
	do {
		const page = await apiGet(path, cursor ? { ...params, cursor, limit: 250 } : { ...params, limit: 250 });
		if (!Array.isArray(page.data)) throw new Error(`Unexpected response shape from ${path}: no data array.`);
		items.push(...page.data);
		cursor = page.nextCursor ?? undefined;
	} while (cursor);
	return items;
}

// --- helpers ----------------------------------------------------------------

const daysSince = (iso) => (Date.now() - new Date(iso).getTime()) / 86_400_000;

// Header/query keys that carry a secret when they carry anything at all.
const SECRET_KEYS = /^(authorization|proxy-authorization|x-api-key|api-key|apikey|x-auth-token|private-token|token|access[_-]?token|secret|password)$/i;

// Values that are unmistakably a live credential rather than a placeholder.
const SECRET_VALUES = [
	/\bbearer\s+[A-Za-z0-9._~+/-]{12,}/i,
	/\bsk-[A-Za-z0-9_-]{16,}/,
	/\bxox[baprs]-[A-Za-z0-9-]{10,}/,
	/\bghp_[A-Za-z0-9]{20,}/,
	/\bgithub_pat_[A-Za-z0-9_]{20,}/,
	/\bAIza[A-Za-z0-9_-]{20,}/,
	/\bey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/, // JWT
	/\bAKIA[0-9A-Z]{16}\b/,
	/\bglpat-[A-Za-z0-9_-]{16,}/,
];

// An n8n expression that pulls the value from somewhere safe is not a pasted secret.
const isSafeReference = (value) =>
	typeof value === 'string' && value.startsWith('=') && /\$(credentials|env|secrets|vars)\b/.test(value);

const looksLikeSecret = (value) =>
	typeof value === 'string' && value.length >= 12 && !isSafeReference(value) && SECRET_VALUES.some((re) => re.test(value));

/** Walk an HTTP Request node's parameters looking for a literal credential. */
function findInlineSecrets(node) {
	const hits = [];

	const visit = (value, trail) => {
		if (value === null || value === undefined) return;

		if (Array.isArray(value)) {
			// n8n stores headers/query as [{ name, value }, ...]
			for (const entry of value) {
				if (entry && typeof entry === 'object' && 'name' in entry && 'value' in entry) {
					const key = String(entry.name ?? '');
					const val = entry.value;
					if (SECRET_KEYS.test(key.trim()) && typeof val === 'string' && val.trim() !== '' && !isSafeReference(val)) {
						hits.push({ where: `${trail}.${key}`, reason: 'secret-bearing header/query parameter set to a literal value' });
						continue;
					}
					if (looksLikeSecret(val)) {
						hits.push({ where: `${trail}.${key}`, reason: 'value matches a known credential format' });
						continue;
					}
				}
				visit(entry, trail);
			}
			return;
		}

		if (typeof value === 'object') {
			for (const [k, v] of Object.entries(value)) visit(v, trail ? `${trail}.${k}` : k);
			return;
		}

		if (looksLikeSecret(value)) {
			hits.push({ where: trail, reason: 'value matches a known credential format' });
		}
	};

	visit(node.parameters ?? {}, 'parameters');
	return hits;
}

const HTTP_NODE_TYPES = new Set([
	'n8n-nodes-base.httpRequest',
	'n8n-nodes-base.httpRequestTool',
	'@n8n/n8n-nodes-langchain.toolHttpRequest',
]);

// --- checks -----------------------------------------------------------------

function checkEncryptionKey() {
	const envKey = process.env.N8N_ENCRYPTION_KEY;
	const result = { envKeySet: Boolean(envKey), backupPath: KEY_BACKUP ?? null, backupOk: false, notes: [] };

	if (!envKey) {
		result.notes.push(
			'N8N_ENCRYPTION_KEY is not set in this process. If it is not set for the n8n process either, n8n generated ' +
				'a random key into ~/.n8n/config on first boot. Lose that file and every stored credential is unrecoverable ' +
				'ciphertext, database backup or not.',
		);
	}

	if (!KEY_BACKUP) {
		result.notes.push('No --key-backup path given, so no backup could be verified.');
		return result;
	}

	const stat = statSync(KEY_BACKUP); // throws loudly if the "backup" is not there
	if (stat.size === 0) throw new Error(`Encryption key backup ${KEY_BACKUP} exists but is empty.`);

	const backed = readFileSync(KEY_BACKUP, 'utf8').trim();
	if (backed === '') throw new Error(`Encryption key backup ${KEY_BACKUP} contains only whitespace.`);

	if (envKey && backed !== envKey.trim()) {
		throw new Error(
			`Encryption key backup ${KEY_BACKUP} does not match N8N_ENCRYPTION_KEY. One of them is stale. ` +
				'Fix this before you need it.',
		);
	}

	result.backupOk = true;
	if (!envKey) {
		result.notes.push(
			`A backup file exists at ${KEY_BACKUP} but N8N_ENCRYPTION_KEY is not set here, so it could not be verified ` +
				'against the live key. Run this on the n8n host with the key in the environment.',
		);
	}
	return result;
}

async function audit() {
	const workflows = await apiGetAll('/workflows', { excludePinnedData: true });
	const credentials = await apiGetAll('/credentials');

	const live = workflows.filter((w) => !w.isArchived);
	const active = live.filter((w) => w.active);

	// 1. active workflows with no error workflow
	const noErrorWorkflow = active
		.filter((w) => !w.settings?.errorWorkflow)
		.map((w) => ({ id: w.id, name: w.name }));

	// credential id -> workflows using it, harvested from node payloads
	const credentialUsage = new Map();
	const inlineSecrets = [];

	for (const wf of live) {
		for (const node of wf.nodes ?? []) {
			for (const ref of Object.values(node.credentials ?? {})) {
				if (!ref?.id) continue;
				if (!credentialUsage.has(ref.id)) credentialUsage.set(ref.id, []);
				credentialUsage.get(ref.id).push({ workflowId: wf.id, workflowName: wf.name, active: wf.active });
			}

			if (!HTTP_NODE_TYPES.has(node.type)) continue;
			if (node.disabled) continue;

			const hits = findInlineSecrets(node);
			if (hits.length > 0) {
				inlineSecrets.push({
					workflowId: wf.id,
					workflowName: wf.name,
					node: node.name,
					usesCredentialObject: Object.keys(node.credentials ?? {}).length > 0,
					hits,
				});
			}
		}
	}

	// 2. credentials with a single owner
	const singleOwner = credentials
		.map((c) => {
			const shared = Array.isArray(c.shared) ? c.shared : [];
			const owners = shared.filter((s) => s.role === 'credential:owner');
			const usedBy = credentialUsage.get(c.id) ?? [];
			return {
				id: c.id,
				name: c.name,
				type: c.type,
				projects: shared.length,
				owner: owners[0]?.project?.name ?? null,
				usedByWorkflows: usedBy.length,
				usedByActiveWorkflows: usedBy.filter((u) => u.active).length,
			};
		})
		.filter((c) => c.projects <= 1);

	// 3. stale active workflows
	const stale = active
		.filter((w) => daysSince(w.updatedAt) > STALE_DAYS)
		.map((w) => ({ id: w.id, name: w.name, daysSinceUpdate: Math.floor(daysSince(w.updatedAt)) }))
		.sort((a, b) => b.daysSinceUpdate - a.daysSinceUpdate);

	// 4. encryption key
	const encryptionKey = checkEncryptionKey();

	// --- score ---------------------------------------------------------------
	// The weights below are a judgement call, not a measurement. Argue with them,
	// edit them, but write down why. What matters is that the same instance scores
	// the same way next quarter.
	const loadBearing = singleOwner.filter((c) => c.usedByActiveWorkflows > 0);

	const penalties = [
		{
			label: 'Encryption key not provably backed up',
			count: encryptionKey.backupOk && encryptionKey.envKeySet ? 0 : 1,
			each: 30,
			cap: 30,
		},
		{ label: 'Active workflow with no error workflow', count: noErrorWorkflow.length, each: 3, cap: 25 },
		{ label: 'HTTP Request node with a pasted secret', count: inlineSecrets.length, each: 8, cap: 20 },
		{ label: 'Single-owner credential used by an active workflow', count: loadBearing.length, each: 2, cap: 15 },
		{ label: `Active workflow untouched in ${STALE_DAYS}+ days`, count: stale.length, each: 1, cap: 10 },
	].map((p) => ({ ...p, deducted: Math.min(p.count * p.each, p.cap) }));

	const score = Math.max(0, 100 - penalties.reduce((sum, p) => sum + p.deducted, 0));

	return {
		instance: BASE_URL,
		generatedAt: new Date().toISOString(),
		score,
		totals: {
			workflows: live.length,
			activeWorkflows: active.length,
			credentials: credentials.length,
		},
		penalties,
		findings: {
			noErrorWorkflow,
			inlineSecrets,
			singleOwnerCredentials: singleOwner,
			loadBearingSingleOwnerCredentials: loadBearing,
			staleActiveWorkflows: stale,
			encryptionKey,
		},
	};
}

// --- report -----------------------------------------------------------------

function report(r) {
	const line = (s = '') => process.stdout.write(`${s}\n`);
	const pad = (s, n) => String(s).padEnd(n);

	line();
	line(`n8n bus-factor audit  ${r.instance}`);
	line(`${r.totals.workflows} workflows (${r.totals.activeWorkflows} active), ${r.totals.credentials} credentials`);
	line('-'.repeat(72));
	line(`SCORE: ${r.score}/100`);
	line('-'.repeat(72));

	for (const p of r.penalties) {
		line(`${pad(p.label, 52)} ${pad(p.count, 5)} -${p.deducted}`);
	}
	line();

	if (!r.findings.encryptionKey.backupOk || !r.findings.encryptionKey.envKeySet) {
		line('ENCRYPTION KEY');
		for (const note of r.findings.encryptionKey.notes) line(`  ! ${note}`);
		line();
	}

	if (r.findings.noErrorWorkflow.length) {
		line('ACTIVE WORKFLOWS WITH NO ERROR WORKFLOW (they fail silently)');
		for (const w of r.findings.noErrorWorkflow) line(`  - ${w.name}  [${w.id}]`);
		line();
	}

	if (r.findings.inlineSecrets.length) {
		line('SECRETS PASTED INTO HTTP REQUEST NODES (not in a credential object)');
		for (const s of r.findings.inlineSecrets) {
			line(`  - ${s.workflowName} > ${s.node}  [${s.workflowId}]`);
			for (const h of s.hits) line(`      ${h.where}: ${h.reason}`);
		}
		line();
	}

	if (r.findings.loadBearingSingleOwnerCredentials.length) {
		line('SINGLE-OWNER CREDENTIALS BEHIND ACTIVE WORKFLOWS');
		for (const c of r.findings.loadBearingSingleOwnerCredentials) {
			line(`  - ${c.name} (${c.type})  owner: ${c.owner ?? 'unknown'}  active workflows: ${c.usedByActiveWorkflows}`);
		}
		line();
	}

	if (r.findings.staleActiveWorkflows.length) {
		line(`ACTIVE BUT UNTOUCHED FOR ${STALE_DAYS}+ DAYS`);
		for (const w of r.findings.staleActiveWorkflows) line(`  - ${pad(w.name, 44)} ${w.daysSinceUpdate}d`);
		line();
	}
}

// --- run --------------------------------------------------------------------

const result = await audit();

if (JSON_OUT) {
	process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
} else {
	report(result);
}

if (FAIL_UNDER !== null && result.score < FAIL_UNDER) {
	process.stderr.write(`Score ${result.score} is below --fail-under ${FAIL_UNDER}.\n`);
	process.exit(1);
}