Automated Decrypted Credential Backup to GitHub - n8n Workflow

• n8n Instance Administrators requiring robust data disaster recovery plans.


• DevOps teams managing self-hosted n8n environments.


• Users looking for reliable n8n templates for credential security.


• Anyone needing version control for sensitive configuration files or critical n8n data.

Securing your credentials is paramount for maintaining a highly available n8n instance. This solution provides a reliable, automated way to protect your configuration data. By leveraging command line execution and complex scripting within an n8n node structure, this n8n workflow decrypts and exports all credentials periodically (every two hours by default). Crucially, the automation uses version control logic: it only updates files on GitHub if a difference is detected, ensuring a clean commit history.

This advanced n8n workflow utilizes a self-calling subworkflow pattern to process each credential individually, optimizing memory usage and scalability, making it one of the most essential n8n templates for self-hosting users who require robust data backup.

1. The n8n trigger (either the Schedule Trigger or the Manual Trigger) starts the process.


2. An Execute Command n8n node runs npx n8n export:credentials --all --decrypted to gather all sensitive credential data.


3. The Code n8n node parses the large JSON string output from the command line, extracting the array of individual credentials and formatting them for the main n8n workflow loop.


4. The n8n workflow splits the credentials using the Loop Over Items n8n node and then uses the Execute Workflow n8n node to call itself (the subworkflow) for each credential item.


5. In the subworkflow, the Globals n8n node injects the required GitHub repository details (Owner, Name, Path).


6. A GitHub n8n node attempts to retrieve the existing credential file from the repository, using the credential ID as the filename ({ID}.json).


7. The Code n8n node named isDiffOrNew executes sophisticated comparison logic: it decodes the existing GitHub JSON (if present), orders the keys of both the old and new JSON objects to ensure reliable comparison, and determines if the current n8n credential data is "same", "different", or "new."


8. A Switch n8n node directs the flow: if "different," an Edit existing file GitHub n8n node updates the file; if "new," a Create new file GitHub n8n node uploads it; if "same," the process skips updating, saving API rate limits.


9. The subworkflow concludes and returns, allowing the main loop to continue processing the next credential item.

1. Import this n8n workflow JSON into your n8n instance.


2. Set Credentials: Establish a valid GitHub account credential within n8n and select it for the GitHub n8n nodes (Get file data, Create new file, Edit existing file). Ensure this account has push permissions to the target repository.


3. Configure Globals: Open the Globals Set n8n node (located around the start of the subworkflow). Update the values:

1. Prerequisite: This n8n workflow requires that your n8n instance has access to the command line utility and that the npx n8n command can be executed.


2. Activation: Enable the Schedule n8n trigger to run the automated backup every two hours.

Schedule Trigger / On clicking 'execute': The n8n trigger points for the automation. The Schedule Trigger runs the backup routinely every two hours.
Execute Command: Executes the shell command npx n8n export:credentials --all --decrypted to retrieve all currently configured, decrypted n8n credential JSON data.
JSON formatting (Code n8n node): Handles the complex task of parsing the large raw output from the shell command, which contains all credentials, and separates them into distinct data items for the subsequent n8n node loops.
Execute Workflow: A crucial flow control n8n node that calls the current n8n workflow recursively, initiating the subworkflow execution for each individual credential item.
Globals (Set n8n node): Stores configuration variables, including the target repo.owner, repo.name, and repo.path for the GitHub operations. This node must be edited during setup.
Get file data (GitHub n8n node): Attempts to fetch the existing backup file from GitHub, using the unique credential ID as the filename. It is configured to run even if the file is not found (using continueOnFail) to handle new credentials.
isDiffOrNew (Code n8n node): This advanced scripting n8n node performs the core comparison logic. It reliably determines if the current credential JSON differs from the backed-up version by standardizing (ordering) the JSON keys before performing a string comparison, setting the githubstatus property.
Check Status (Switch n8n node): Directs the flow based on the githubstatus output. This ensures that the GitHub API is only called to commit changes when the data is truly different or new.

• Create new file / Edit existing file (GitHub n8n node): The final action n8n nodes that perform the necessary write operations to the GitHub repository based on the comparison status.