# Credentials File Encryption warnings and IBM + Cloudant

**URL:** https://discourse.nodered.org/t/credentials-file-encryption-warnings-and-ibm-cloudant/12560
**Category:** General
**Created:** [24 June 2019 20:57 UTC](https://discourse.nodered.org/t/credentials-file-encryption-warnings-and-ibm-cloudant/12560 "2019-06-24T20:57:33Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![PJMcL](https://avatars.discourse-cdn.com/v4/letter/p/a88e57/32.png) [@PJMcL](https://discourse.nodered.org/u/PJMcL)
#### Post date: [24 June 2019 20:57 UTC](https://discourse.nodered.org/t/credentials-file-encryption-warnings-and-ibm-cloudant/12560/1 "2019-06-24T20:57:33Z")

</div>

Hi, After some disruption of NodeRED instance, I'm being hampered by the message:

_Your flow credentials file is encrypted using a system-generated key._

_If the system-generated key is lost for any reason, your credentials_  
_file will not be recoverable, you will have to delete it and re-enter_  
_your credentials._

_You should set your own key using the 'credentialSecret' option in_  
_your settings file. Node-RED will then re-encrypt your credentials_  
_file using your chosen key the next time you deploy a change._

Because I'm working in IBMCloud, there are no config 'files', but these are instead documents within Cloudant's NodeRED database. Everything is dfone through Cloudant.  
The system doesn't seem to flush out the old credentials in the way it announces. I don't seem to be able to flush them myself either.  
As to 'decrypting the file', I have tried clearing the credentials string (to the RHS of the $: "") and a few variants of that (empty object, no object).

I've tried setting a manual 'credentialSecret' (in a Cloudant based config it looks as if this is held in settings, even when it's the autogenerated one, it also seems to be prefixed with an \_ as many 'special names' are.. but maybe removing the underscore would be important to activate it. Finally I note that some articles say this value if set can never be changed - does that mean I only get one chance to try setting it)

Perhaps someone has seen his before?  
I'd even be satisfied with temporarrily turning off the encryption of these credentials within our IBMCloud and adding it back in once the problem's been solved.

At present I can start the old flows fine, but I can't enter the credentials to NodeRED in such a way that they stay in the system and are used.

Can anyone steer me right with this one, please?