# Credential management

**URL:** <https://discourse.nodered.org/t/credential-management/49845>\
**Category:** General\
**Created:** [17 August 2021 13:19 UTC](https://discourse.nodered.org/t/credential-management/49845 "2021-08-17T13:19:45Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ostro](https://avatars.discourse-cdn.com/v4/letter/o/91b2a8/32.png) [@Ostro](https://discourse.nodered.org/u/Ostro)\
**Post date:** [17 August 2021 13:19 UTC](https://discourse.nodered.org/t/credential-management/49845/1 "2021-08-17T13:19:45Z")

</div>

Hi,

I doesn't understand how the credential works in node-red.  
I read about the flow.cred.son, the setting file to choose the hash key and so on.  
But i didn't find an simple explanation to store a credential and use it in a flow. Someone can help?

What i want :

- save some credential
- retrieve one and use it in the flow

I aware that i can use some crypto and store the value in a separate file but if node-red have a build-in functionnality, i prefered use it.

I seek for someting clear but the forum is flood by exporting flow issue and i couldn't find something in the doc or in the cookbook.

Thx

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [17 August 2021 13:26 UTC](https://discourse.nodered.org/t/credential-management/49845/2 "2021-08-17T13:26:44Z")

</div>

Credentials are specific to a node.

When the node is written you flag which of it's properties should be considered credentials and these are then encrypted with the key mentioned and stored in the separate file. They can be retrieved by the `js` portion of the node when it is initialised and used as needed.

It sounds like you want to store arbitrary values as credentials and use them in your flow (e.g. pass them into a later http-request node)?

This is not something supported by the built in credentials system.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [17 August 2021 13:34 UTC](https://discourse.nodered.org/t/credential-management/49845/3 "2021-08-17T13:34:05Z")

</div>

> [@hardillb](#):
>
> When the node is written

Just to be clear, this happens when the author of the custom node designs and builds it. It isn't something user selectable.

> [@Ostro](#):
>
> What i want

If I remember rightly, there is a custom node that lets you pass something out to and retreive something as a credential.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [17 August 2021 13:36 UTC](https://discourse.nodered.org/t/credential-management/49845/4 "2021-08-17T13:36:05Z")

</div>

If you want to make use of credentials in your flow (for example in a Function node) then you can use this node: [node-red-contrib-credentials (node) - Node-RED](https://flows.nodered.org/node/node-red-contrib-credentials)

It lets you store values in the flow credentials flow and retrieve them to use in your flow.

You have actually reminded me that I spoke to its author ages ago about pulling it into the core as its a genuinely useful thing to have. We should follow up on that.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [17 August 2021 13:37 UTC](https://discourse.nodered.org/t/credential-management/49845/5 "2021-08-17T13:37:21Z")

</div>

Maybe it would be worth considering adding a feature to make it another standard type as with global/flow/context variables?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [17 August 2021 13:53 UTC](https://discourse.nodered.org/t/credential-management/49845/6 "2021-08-17T13:53:27Z")

</div>

That would make a lot of sense from an end-user perspective. The implementation is harder though given how credentials are managed. Nodes have to declare to the runtime what properties are credentials. The contrib-credentials node declares a single property which it stores all of its credentials under and the runtime doesn't need to know about the individual values.

To allow any TypedInput to have a credential type would mean any node could have an indeterminate number of credentials - which makes them harder to manage. But that's a problem for me to solve in the core.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [17 August 2021 14:58 UTC](https://discourse.nodered.org/t/credential-management/49845/7 "2021-08-17T14:58:31Z")

</div>

> [@knolleary](#):
>
> But that's a problem for me to solve in the core.

We like to keep life interesting for you 😀

Maybe a quick win to adopt the current node with the further integration later?

---

<div class="post-metadata">

**Author:** ![Ostro](https://avatars.discourse-cdn.com/v4/letter/o/91b2a8/32.png) [@Ostro](https://discourse.nodered.org/u/Ostro)\
**Post date:** [18 August 2021 14:33 UTC](https://discourse.nodered.org/t/credential-management/49845/8 "2021-08-18T14:33:20Z")

</div>

Hi,

Thx for all the replies.

@knolleary I know the contrib-credential but it have a issue wich is the hiden password field is not hiden. That means you can not let someone see the flow on the device if you don't want give him the password.

So, go with contrib-crypto-js and make another file to handle the credentials seems to me a good alternative. Do you agree with that?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [18 August 2021 14:46 UTC](https://discourse.nodered.org/t/credential-management/49845/9 "2021-08-18T14:46:23Z")

</div>

> [@Ostro](#):
>
> the hiden password field is not hiden. That means you can not let someone see the flow on the device if you don't want give him the password.

I don't quite understand what you mean.

As far as I know, the node stores credentials in the credentials file, which should be encrypted. Can you expand on what the issue is?

---

<div class="post-metadata">

**Author:** ![Ostro](https://avatars.discourse-cdn.com/v4/letter/o/91b2a8/32.png) [@Ostro](https://discourse.nodered.org/u/Ostro)\
**Post date:** [18 August 2021 16:02 UTC](https://discourse.nodered.org/t/credential-management/49845/10 "2021-08-18T16:02:52Z")

</div>

@knolleary When you use the contrib-credential, in the node editor, if you set the value to be hiden it doen't hide it.

 ![credential](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/4/e/4e66e1ec1e22ee576db312aec93e1dee0af728fb.png)

I think again about my use case and i think i will go with the contrib-credential and put it inside a subflow. It will be great to have the possibility to put a msg properti in the env variable of the subflow, it is in your plan?

Have you ever think to hide a property in the debug tab that come out of a specific node for some user ? Like a specific node which contain a property to put a user and if this user is not the current user the user property couldn't be change and the message wouldn't be treated by the debug node.

---

<div class="post-metadata">

**Author:** ![zenofmud](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/zenofmud/32/316_2.png) [@zenofmud](https://discourse.nodered.org/u/zenofmud)\
**Post date:** [18 August 2021 16:06 UTC](https://discourse.nodered.org/t/credential-management/49845/11 "2021-08-18T16:06:13Z")

</div>

@knolleary Nick, Just took a look at the issues for the node and it seems this cropped up about NR v1.02  
(see [Hidden field not hidden](https://github.com/Steveorevo/node-red-contrib-credentials/issues/3)) ad a fix was created and offered for merging in May of 2020 but has not been applied.

@Ostro You should add your voice to the issue on GitHub: [Hidden field not hidden](https://github.com/Steveorevo/node-red-contrib-credentials/issues/3)

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [18 August 2021 16:06 UTC](https://discourse.nodered.org/t/credential-management/49845/12 "2021-08-18T16:06:31Z")

</div>

> [@Ostro](#):
>
> put a msg properti in the env variable of the subflow, it is in your plan?

No, That is not going to happen. Subflow Properties are evaluated when the flow starts - they cannot dynamically changed.

> [@Ostro](#):
>
> Have you ever think to hide a property in the debug tab that come out of a specific node for some user ?

No - nothing like that has been discussed.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [18 August 2021 16:36 UTC](https://discourse.nodered.org/t/credential-management/49845/13 "2021-08-18T16:36:45Z")

</div>

> [@zenofmud](#):
>
> Nick, Just took a look at the issues for the node and it seems this cropped up about NR v1.02

Okay - I'll put this topic on the backlog for 2.1.0. Whether we introduce an equivalent node into the core, or find another way to integrate credential values, I don't know. But we can give it some proper thought.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [17 October 2021 16:37 UTC](https://discourse.nodered.org/t/credential-management/49845/14 "2021-10-17T16:37:15Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.