# Credentials in API flows

**URL:** <https://discourse.nodered.org/t/credentials-in-api-flows/39693>\
**Category:** General\
**Created:** [25 January 2021 08:22 UTC](https://discourse.nodered.org/t/credentials-in-api-flows/39693 "2021-01-25T08:22:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![donalddck](https://avatars.discourse-cdn.com/v4/letter/d/eb9ed0/32.png) [@donalddck](https://discourse.nodered.org/u/donalddck)\
**Post date:** [25 January 2021 08:22 UTC](https://discourse.nodered.org/t/credentials-in-api-flows/39693/1 "2021-01-25T08:22:01Z")

</div>

Hello,

I'm trying to use the flows api (GET) to retrieve all configurations.  
In the API result there aren't the nodes credentials  
For example in mqtt-broker config there are all configurations but there aren't Security configuration.  
It it possible to retrieve it?

thank you very much,  
D

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [25 January 2021 09:14 UTC](https://discourse.nodered.org/t/credentials-in-api-flows/39693/2 "2021-01-25T09:14:45Z")

</div>

no - that would be awful for security.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [25 January 2021 09:35 UTC](https://discourse.nodered.org/t/credentials-in-api-flows/39693/3 "2021-01-25T09:35:32Z")

</div>

Hi @donalddck

we do not currently return any password credentials via the API - this is to ensure they cannot be accidentally accessed if the admin api were to be left unsecured.

It is something I've been thinking about a bit - there are plenty of cases where, if done properly, it would be useful to be able to access the credentials. We just need to make sure it is done securely and that users don't accidentally expose their credentials.

Your question has prompted me to write up my thoughts on this and to start a discussion on the design here: [Provide Admin API access to flow credentials · Discussion #44 · node-red/designs · GitHub](https://github.com/node-red/designs/discussions/44)

If you, or anyone reading this, has comments on the design, please do chip in - either here, or preferably over on the GitHub discussion linked above.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [26 March 2021 09:35 UTC](https://discourse.nodered.org/t/credentials-in-api-flows/39693/4 "2021-03-26T09:35:56Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.