The n8n Public API: what it can do, what it can't, and when to turn it off

The n8n Public API lets you control workflows, executions, credentials, users, tags, variables, and other resources of your n8n instance via REST calls, under the base path /api/v1 and secured by an API key in the X-N8N-API-KEY header. It is suited for anything you would otherwise do manually in the interface and instead want to automate from your own script, a pipeline, or another system. As of: August 2026.

Which resources does the API actually cover?

The API covers, among other things, workflows, executions, credentials, users, audit log, tags, source control, variables, data tables, and projects, each as its own resource group with its own endpoints. This means you can, for example, create, activate, or deactivate workflows via script, pull execution data for reporting, or manage variables centrally, without clicking through the interface. You can find the full list of all endpoints in the n8n API reference.

Where are the limits of the Public API?

The biggest practical limit is pagination: by default a list endpoint returns 100 entries per call, up to a maximum of 250, so on large instances with many workflows or executions you need to make several calls with a cursor. With data tables there is an additional limit: by default, total storage is capped at 50 MB instance-wide. And anyone using n8n Cloud during the free trial period has no access to the API at all, the feature only becomes available after upgrading to a paid plan.

How do you create and manage an API key?

You create an API key under Settings, then n8n API, via the button for creating a new key, where you assign a label and optionally an expiration time. On Enterprise instances you can additionally restrict the key to specific resources and actions, so-called scopes, while a key on a non-Enterprise instance automatically has full access to all resources of the account. Details on authentication and the available scopes can be found in the n8n API authentication.

When should you rather turn off the Public API?

You should turn off the Public API if you are not actually actively using it, because every active interface is an additional attack surface, especially on a self-hosted instance without Enterprise scopes, where a compromised key means full access. Without an Enterprise license, access cannot be restricted granularly, which is why the simplest and safest option is often to disable the API entirely, if no external system depends on it. Anyone running n8n in production in their own data center should tackle such hardening questions systematically anyway, for example as part of n8n operations consulting.

Frequently asked questions about the n8n Public API

Can I also read out credentials with the API?

The credential resource of the API allows you to create and manage credentials; for security reasons, n8n does not return the stored secret values themselves in plain text. For pure management, such as assigning credentials to workflows, this is usually sufficient in practice.

Does the Public API replace the n8n CLI?

No, the two tools complement each other rather than replacing one another: the API is aimed at remote, programmatic access via HTTP, while the CLI is intended for administrative tasks directly on the server, for example when importing and exporting workflows during a deployment. Which tool fits depends on the specific use case.

Does the API work the same way on n8n Cloud as self-hosted?

Basically yes, with the difference that the API on n8n Cloud is locked during the free trial period and only unlocked with a paid plan. Self-hosted instances do not have this restriction, but in return you bear full responsibility there for securing access.

How many API keys can I create at the same time?

You can create multiple API keys in parallel, which is useful for giving different external systems each their own key with its own label and its own expiration time, instead of sharing a single key everywhere. This also makes it easier to revoke a compromised or no longer needed key in a targeted way, without interrupting other integrations.