How to Secure n8n with Basic Authentication

For n8n versions before v2, set three environment variables to enable basic authentication. N8N_BASIC_AUTH_ACTIVE enables the feature, and the other two set the credentials. After setting these variables, restart n8n. Every request to the n8n UI and API will require these credentials. This method uses HTTP Basic Authentication, which sends credentials in base64-encoded headers. Always use HTTPS in production to prevent credentials from being intercepted.

1# Set basic auth environment variables
2export N8N_BASIC_AUTH_ACTIVE=true
3export N8N_BASIC_AUTH_USER=admin
4export N8N_BASIC_AUTH_PASSWORD=your-strong-password-here
5
6# Restart n8n
7n8n start

When running n8n in Docker, pass the basic auth environment variables via docker run flags or a docker-compose.yml file. The compose approach is recommended because it keeps your configuration in a version-controlled file and makes it easy to update. Never put passwords directly in a Dockerfile or commit them to version control. Use a .env file alongside your docker-compose.yml instead.

1# docker-compose.yml with basic auth (legacy)
2version: '3.8'
3services:
4  n8n:
5    image: docker.n8n.io/n8nio/n8n
6    restart: unless-stopped
7    ports:
8      - '5678:5678'
9    environment:
10      - N8N_BASIC_AUTH_ACTIVE=true
11      - N8N_BASIC_AUTH_USER=${N8N_USER}
12      - N8N_BASIC_AUTH_PASSWORD=${N8N_PASSWORD}
13    volumes:
14      - n8n_data:/home/node/.n8n
15
16volumes:
17  n8n_data:

Basic auth is deprecated in n8n v2 and later. Instead, n8n now includes built-in user management with proper account creation, password hashing, and role-based access. When you first start n8n v2 without any users configured, it presents a setup screen where you create an owner account. Remove the basic auth environment variables and let n8n handle authentication natively. This is more secure because passwords are hashed with bcrypt instead of sent as plaintext in HTTP headers.

1# Remove deprecated basic auth variables
2# Delete or comment out these lines:
3# N8N_BASIC_AUTH_ACTIVE=true
4# N8N_BASIC_AUTH_USER=admin
5# N8N_BASIC_AUTH_PASSWORD=password
6
7# n8n v2+ uses built-in user management
8# Just start n8n — it will prompt you to create an owner account
9n8n start
10
11# To disable user management (NOT recommended):
12# export N8N_USER_MANAGEMENT_DISABLED=true

Regardless of which authentication method you use, place n8n behind a reverse proxy like Nginx or Caddy for production deployments. A reverse proxy adds TLS encryption (HTTPS), rate limiting, and IP-based access controls. This prevents credentials from being transmitted in plaintext and adds defense-in-depth. The reverse proxy handles SSL termination while n8n runs on HTTP internally.

1# Nginx configuration for n8n with SSL
2server {
3    listen 443 ssl;
4    server_name n8n.example.com;
5
6    ssl_certificate /etc/letsencrypt/live/n8n.example.com/fullchain.pem;
7    ssl_certificate_key /etc/letsencrypt/live/n8n.example.com/privkey.pem;
8
9    location / {
10        proxy_pass http://localhost:5678;
11        proxy_set_header Host $host;
12        proxy_set_header X-Real-IP $remote_addr;
13        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
14        proxy_set_header X-Forwarded-Proto $scheme;
15        proxy_http_version 1.1;
16        proxy_set_header Upgrade $http_upgrade;
17        proxy_set_header Connection "upgrade";
18    }
19}