How to secure n8n with basic auth?

The simplest and correct way to secure n8n with Basic Auth is to set two environment variables where n8n runs: N8N_BASIC_AUTH_ACTIVE=true and a username/password via N8N_BASIC_AUTH_USER and N8N_BASIC_AUTH\_PASSWORD. Once you restart n8n, anyone visiting the n8n editor or any endpoint that is not a webhook must enter this Basic Auth username and password.

 

What Basic Auth in n8n Actually Does

 

Basic Auth in n8n protects the n8n editor UI and the REST API. It does not protect public webhooks. n8n webhooks always stay public unless you secure them yourself with keys, signatures, or custom logic in the workflow.

Basic Auth is essentially a “login wall” your browser shows before you can see the n8n UI. It’s not fancy, but it’s reliable and simple, which is why it’s the recommended minimum security when your instance is exposed to the internet.

 

How to Enable Basic Auth (Production‑safe Setup)

 

You secure n8n with Basic Auth by setting the following environment variables wherever n8n runs (Docker, server, or cloud):

// Enable Basic Auth
export N8N_BASIC_AUTH_ACTIVE=true

// Choose your login username
export N8N_BASIC_AUTH_USER=admin

// Choose a strong password
export N8N_BASIC_AUTH_PASSWORD="a-strong-password"

If you use Docker, this goes into your docker run command or your docker-compose.yml file. After setting the variables, restart the n8n service so the settings take effect.

 

Example: Docker Compose Setup

 

services:
  n8n:
    image: n8nio/n8n
    environment:
      N8N_BASIC_AUTH_ACTIVE: "true"          // turn Basic Auth on
      N8N_BASIC_AUTH_USER: "admin"           // login username
      N8N_BASIC_AUTH_PASSWORD: "myPassword"  // login password
    ports:
      - "5678:5678"

After restarting:

• Your browser will prompt for username and password when you open n8n.
• API access also requires this Basic Auth.

 

Important Things to Know (Real‑world Experience)

 

• This does NOT secure your webhooks. Webhooks stay public so external systems (Stripe, Notion, Slack, etc.) can call them. If you need to secure a webhook, do it inside the workflow using signatures or shared keys.
• Use HTTPS. Basic Auth sends credentials with every request. Without HTTPS, they travel unencrypted.
• Don’t commit these values to git. Store them in environment variables or a secret manager.
• Works with the editor + API only. It doesn’t change execution of workflows or trigger behavior.

 

Why This Matters in Production

 

Running n8n without Basic Auth on a public URL is unsafe. Bots and scanners will find the endpoint within hours and hammer it. Basic Auth is the minimum layer of protection you should always enable before exposing n8n to the internet. It’s lightweight, built-in, and doesn’t interfere with workflows or operations.

This setup keeps your instance protected while staying simple, predictable, and fully supported by n8n.