How to Get Your n8n API Key (Self-Hosted and Cloud)

The n8n API key is how external tools talk to your n8n instance without clicking through the UI. It's also the only thing standing between you and a 401 Unauthorized error the first time you try to deploy a workflow via curl.

Three clicks to generate it. Zero clicks if you miss the copy window, and then it's delete and regenerate. The key is shown exactly once, which is either good security practice or a deliberate way to keep you on your toes. Probably both.

Why you need the API key

n8n exposes a REST API that lets you import workflows, activate them, and update credentials without touching the UI. This is how automated deployments work: one curl command pushes your workflow JSON straight into your n8n instance.

Without the API key, that command returns 401 Unauthorized. With it, you can deploy, activate, and verify a workflow from the command line. The key also covers triggering workflows externally, listing executions, and updating credentials programmatically.

It's the front door to everything n8n exposes outside its own interface. If you're working through our self-hosted n8n VPS setup guide, you'll need this key before any of the deployment steps will run.

Generate the key on a self-hosted instance

If your n8n instance is already deployed and running, here's the path to your key:

1. Open your n8n dashboard in a browser and log in. On a first visit, n8n prompts you to create an owner account before anything else.
2. In the bottom-left corner, click the gear icon. That's Settings.
3. In the left settings menu, click n8n API.
4. Click Create an API Key. Give it a label (deploy-agent works fine) and click Save.
5. Copy the key immediately. n8n displays it exactly once. Close or refresh the page and only the label remains; the value is gone from the UI for good. n8n stores just a hashed version of the key, not the raw string. Treat it the way you'd treat a one-time PIN from your bank: paste it somewhere safe before you click away.

Your API base URL for this instance is https://your-n8n-domain.com/api/v1. Replace your-n8n-domain.com with the domain your n8n is actually served on. On a fresh VPS before you've pointed a custom domain, it'll look something like https://n8n.yourhost.cloud/api/v1.

Once you've pointed a custom domain and set N8N_HOST in your docker-compose.yml, use that domain instead.

The greyed-out button fix

n8n community edition allows exactly one API key per instance. If the "Create an API Key" button is disabled, a key already exists.

Click the trash icon next to the existing key to delete it, then click Create. The old key stops working the instant it's deleted, so update any tools or scripts that used it before you move on. Not the kind of thing you want to discover at 11pm while a deployment is mid-run.

Encryption key vs. API key

These two have confusingly similar names and nothing to do with each other.

N8N_ENCRYPTION_KEY is a server-side environment variable in your docker-compose.yml. It encrypts the credentials stored in n8n's internal database: API keys, tokens, everything you've connected. It's set once at install time and never changes. You never pass it in an API request, and you never see it in the n8n UI. It's the lock on the vault.

The n8n API key is a token you generate in the n8n UI under Settings, then n8n API. It authenticates REST API requests from external tools, passed as the X-N8N-API-KEY request header. It can be rotated any time. It's the key to the front door.

If you're deploying workflows via curl and getting authentication errors, you need the API key, not the encryption key. If your credentials suddenly stopped working after a server move, check the encryption key instead. Different problems, different fixes.

n8n Cloud

n8n Cloud is the managed version, no server required. As of this writing, plans start around €20/mo for 2,500 executions and rise to around €50/mo for 10,000. Check n8n's own pricing page for current rates, since these change. The path to generate an API key is identical to self-hosted: Settings, n8n API, Create an API Key, same one-time display.

Your API base URL on n8n Cloud is https://[your-instance].app.n8n.cloud/api/v1.

One real difference: n8n Cloud uses {{ $vars.VARIABLE_NAME }} to reference variables in workflows, not {{ $env.VARIABLE_NAME }}. If you're running workflows built for a self-hosted instance, swap those references before you import them.

n8n Cloud is the right call if you'd rather not manage a server. It's the wrong call if your workflows hit execution limits or your data needs to stay on your own infrastructure. If you're not sure which fits, book a call and we'll help you figure it out.

Using the key in curl

Once you have the key, deploying a workflow is one command: curl -X POST "https://your-n8n-domain.com/api/v1/workflows" -H "X-N8N-API-KEY: YOUR_API_KEY" -H "Content-Type: application/json" -d @workflow-main.json.

The -d @workflow-main.json flag reads the workflow JSON from a local file. The response includes the new workflow's id. Use that to activate it: curl -X POST "https://your-n8n-domain.com/api/v1/workflows/WORKFLOW_ID/activate" -H "X-N8N-API-KEY: YOUR_API_KEY".

Before deploying anything, run a quick connectivity test: curl "https://your-n8n-domain.com/api/v1/workflows" -H "X-N8N-API-KEY: YOUR_API_KEY". If that returns a JSON array, your key and base URL are both correct.

A 200 OK with JSON means you're clear. A 401 means the key is wrong. A connection-refused error means the domain or URL is wrong. Fix the one that's actually broken.

The full n8n REST API documentation covers every available endpoint. For environment variables, the n8n configuration methods guide covers self-hosted setup in detail.

Keep it private

The n8n API key grants full access to your instance: create, modify, delete workflows and credentials. Treat it like a database password.

• Store it in a .env file alongside your docker-compose.yml, never hardcoded in scripts
• Add .env to your .gitignore before the first commit, not after
• Never paste it into Slack, Discord, or a support chat. If it ends up in one, rotate it immediately
• Rotate it after anyone with access leaves the team. There's no expiry date, so this is a habit you keep on purpose, not something that happens automatically
• Community edition allows one key per instance. If you suspect it's compromised, delete and regenerate. The old key is invalidated the moment it's deleted

If you're setting up n8n for a Systeme.io-connected workflow, the next step is usually finding your Systeme.io tag IDs, the numeric IDs your n8n workflows use to tag contacts in your CRM.