# Find hardcoded API keys and secrets in an n8n workflow

**Use case:** 

Scan an exported n8n workflow for API keys, tokens and passwords typed into node parameters instead of stored as credentials. Recognises Stripe, OpenAI, Slack, AWS, GitHub, SendGrid and Twilio key formats, JWTs, private-key blocks and hand-set Authorization headers. Every finding names the node and parameter, and the value is masked before it is written, so the output is safe to share.

## Input

```json
{
  "workflowJson": {
    "name": "Daily revenue digest to Slack",
    "nodes": [
      {
        "id": "1",
        "name": "Every morning",
        "type": "n8n-nodes-base.scheduleTrigger",
        "typeVersion": 1.2,
        "position": [
          0,
          0
        ],
        "parameters": {
          "rule": {
            "interval": [
              {
                "field": "hours",
                "hoursInterval": 24
              }
            ]
          }
        }
      },
      {
        "id": "2",
        "name": "Get Stripe charges",
        "type": "n8n-nodes-base.httpRequest",
        "typeVersion": 4.2,
        "position": [
          220,
          0
        ],
        "parameters": {
          "url": "https://api.stripe.com/v1/charges",
          "sendHeaders": true,
          "headerParameters": {
            "parameters": [
              {
                "name": "Authorization",
                "value": "Bearer sk_live_51QcVn2KpZmXrTwYbHf3TgLq8"
              }
            ]
          },
          "options": {
            "timeout": 10000
          }
        }
      },
      {
        "id": "3",
        "name": "Summarise with OpenAI",
        "type": "n8n-nodes-base.httpRequest",
        "typeVersion": 4.2,
        "position": [
          440,
          0
        ],
        "parameters": {
          "url": "https://api.openai.com/v1/chat/completions",
          "method": "POST",
          "sendBody": true,
          "bodyParameters": {
            "parameters": [
              {
                "name": "model",
                "value": "gpt-4o-mini"
              },
              {
                "name": "api_key",
                "value": "sk-proj-8Kq2mVx7RtLpZn4WbYcH3dTfGjA6sQeUiOpKlMnB5vXzCr"
              }
            ]
          },
          "options": {
            "timeout": 30000
          }
        }
      },
      {
        "id": "4",
        "name": "Post to Slack",
        "type": "n8n-nodes-base.httpRequest",
        "typeVersion": 4.2,
        "position": [
          660,
          0
        ],
        "parameters": {
          "url": "https://slack.com/api/chat.postMessage",
          "method": "POST",
          "sendHeaders": true,
          "headerParameters": {
            "parameters": [
              {
                "name": "Authorization",
                "value": "Bearer xoxb-2109384756-4657382910284-9dKp2Vn7RtLqZxYbWcHf3Tg"
              }
            ]
          },
          "options": {
            "timeout": 10000
          }
        }
      },
      {
        "id": "5",
        "name": "Archive to S3",
        "type": "n8n-nodes-base.httpRequest",
        "typeVersion": 4.2,
        "position": [
          880,
          0
        ],
        "parameters": {
          "url": "https://s3.eu-west-1.amazonaws.com/reports/",
          "method": "PUT",
          "sendBody": true,
          "bodyParameters": {
            "parameters": [
              {
                "name": "accessKeyId",
                "value": "AKIA3XV7QW2M5NPDR4TZ"
              },
              {
                "name": "region",
                "value": "eu-west-1"
              }
            ]
          },
          "options": {
            "timeout": 10000
          }
        }
      }
    ],
    "connections": {
      "Every morning": {
        "main": [
          [
            {
              "node": "Get Stripe charges",
              "type": "main",
              "index": 0
            }
          ]
        ]
      },
      "Get Stripe charges": {
        "main": [
          [
            {
              "node": "Summarise with OpenAI",
              "type": "main",
              "index": 0
            }
          ]
        ]
      },
      "Summarise with OpenAI": {
        "main": [
          [
            {
              "node": "Post to Slack",
              "type": "main",
              "index": 0
            }
          ]
        ]
      },
      "Post to Slack": {
        "main": [
          [
            {
              "node": "Archive to S3",
              "type": "main",
              "index": 0
            }
          ]
        ]
      }
    },
    "settings": {
      "errorWorkflow": "err-1"
    }
  },
  "workflowUrls": [],
  "workflowIds": [],
  "activeOnly": false,
  "ruleSet": "security",
  "minSeverity": "low",
  "ignoreRules": [],
  "includeReport": false
}
```

## Output

```json
{
  "severity": {
    "label": "Severity",
    "format": "string"
  },
  "rule": {
    "label": "Rule ID",
    "format": "string"
  },
  "ruleTitle": {
    "label": "Rule",
    "format": "string"
  },
  "category": {
    "label": "Category",
    "format": "string"
  },
  "workflowName": {
    "label": "Workflow",
    "format": "string"
  },
  "nodeName": {
    "label": "Node",
    "format": "string"
  },
  "nodeType": {
    "label": "Node type",
    "format": "string"
  },
  "message": {
    "label": "Finding",
    "format": "string"
  },
  "parameterPath": {
    "label": "Parameter",
    "format": "string"
  },
  "evidence": {
    "label": "Evidence (masked)",
    "format": "string"
  },
  "remediation": {
    "label": "How to fix",
    "format": "string"
  },
  "docsUrl": {
    "label": "Docs",
    "format": "string"
  }
}
```

## About this Actor

This example demonstrates how to use [n8n Workflow Auditor - Linter & Security Review](https://apify.com/mediocre_interest/n8n-workflow-auditor.md) with a specific input configuration. Visit the [Actor detail page](https://apify.com/mediocre_interest/n8n-workflow-auditor.md) to learn more, explore other use cases, and run it yourself.


## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
This Task's input is already configured above — use it as-is rather than inventing a new one.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For full API examples (JavaScript, Python, CLI, MCP, OpenAPI), see this Task's Actor page: https://apify.com/mediocre_interest/n8n-workflow-auditor.md

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).