# credentialSecret not applied when using projects

**URL:** <https://discourse.nodered.org/t/credentialsecret-not-applied-when-using-projects/94388>\
**Category:** General\
**Tags:** security, docker\
**Created:** [6 January 2025 10:19 UTC](https://discourse.nodered.org/t/credentialsecret-not-applied-when-using-projects/94388 "2025-01-06T10:19:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ThingsTinkerer](https://avatars.discourse-cdn.com/v4/letter/t/91b2a8/32.png) [@ThingsTinkerer](https://discourse.nodered.org/u/ThingsTinkerer)\
**Post date:** [6 January 2025 10:19 UTC](https://discourse.nodered.org/t/credentialsecret-not-applied-when-using-projects/94388/1 "2025-01-06T10:19:02Z")

</div>

Got a Node Red running in docker with projects enabled. Originally I had `credentialSecret: false` in settings.js. But now I changed to a secret string (ie. `credentialSecret: "a-secret-string`).

How to enable this? I thought it would be a matter of deleting the old flows\_creds.json, start up NR, perhaps add a node to save some dummy credentials, click deploy and then it would update and encrypt flows\_cred.json. After a restart, the logs would no longer show `[warn] Using unencrypted credentials`. But for the life of me, this won't take effect!

I have verified the settings.js file is being used (added console.log). It prints all the normal values:

> 2025-01-06 11:25:54 Welcome to Node-RED  
> 2025-01-06 11:25:54 ===================  
> 2025-01-06 11:25:54  
> 2025-01-06 11:25:54 6 Jan 10:25:54 - [info] Node-RED version: v4.0.8  
> 2025-01-06 11:25:54 6 Jan 10:25:54 - [info] Node.js version: v20.18.1  
> 2025-01-06 11:25:54 6 Jan 10:25:54 - [info] Linux 5.15.146.1-microsoft-standard-WSL2 x64 LE  
> 2025-01-06 11:25:54 6 Jan 10:25:54 - [info] Loading palette nodes  
> 2025-01-06 11:26:51 6 Jan 10:26:51 - [info] Dashboard version 3.6.5 started at /ui  
> 2025-01-06 11:26:51 6 Jan 10:26:51 - [info] Settings file : /data/settings.js  
> 2025-01-06 11:26:51 6 Jan 10:26:51 - [info] Context store : 'default' [module=memory]  
> 2025-01-06 11:26:51 6 Jan 10:26:51 - [info] User directory : /data  
> 2025-01-06 11:26:51 6 Jan 10:26:51 - [info] Projects directory: /data/projects  
> 2025-01-06 11:26:51 6 Jan 10:26:51 - [info] Server now running at [http://127.0.0.1:1880/](http://127.0.0.1:1880/)  
> 2025-01-06 11:26:53 6 Jan 10:26:53 - [info] Active project : default-nr-project  
> 2025-01-06 11:26:53 6 Jan 10:26:53 - [info] Flows file : /data/projects/default-nr-project/flows.json  
> 2025-01-06 11:26:53 6 Jan 10:26:53 - [warn] Using unencrypted credentials  
> 2025-01-06 11:26:53 6 Jan 10:26:53 - [info] Stopped flows

Any help or suggestions from this excellent community?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [6 January 2025 10:33 UTC](https://discourse.nodered.org/t/credentialsecret-not-applied-when-using-projects/94388/2 "2025-01-06T10:33:53Z")

</div>

If you are using Projects, then the credentialSecret is managed on a per-project basis (as each project may have its own credentialSecret).

To update the credentialSecret settings for a project, open the Project Settings dialog from the menu in the editor (`Menu -> Projects -> Project Settings`). Then open the Settings tab.

In the Files section at the top, click the 'edit' button. Then you can update the encryption settings for the project.

---

<div class="post-metadata">

**Author:** ![ThingsTinkerer](https://avatars.discourse-cdn.com/v4/letter/t/91b2a8/32.png) [@ThingsTinkerer](https://discourse.nodered.org/u/ThingsTinkerer)\
**Post date:** [6 January 2025 10:39 UTC](https://discourse.nodered.org/t/credentialsecret-not-applied-when-using-projects/94388/3 "2025-01-06T10:39:33Z")

</div>

Oh thanks, this goes into .config.projects.json so can set it there!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [20 January 2025 10:40 UTC](https://discourse.nodered.org/t/credentialsecret-not-applied-when-using-projects/94388/4 "2025-01-20T10:40:13Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.