# Export/Import Security Credentials
**URL:** https://discourse.nodered.org/t/export-import-security-credentials/3637
**Category:** Feature Requests
**Created:** [2 October 2018 20:43 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637 "2018-10-02T20:43:40Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@jewendt](https://discourse.nodered.org/u/jewendt)
#### Post date: [2 October 2018 20:43 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/1 "2018-10-02T20:43:41Z")
Problem Statement:
Current export functionality removes all security/setup values for certain nodes (ie Azure Blob Storage) making it difficult to maintain and share across multiple deployed applications.
Feature Request:
Provide an option that would allow export/import functionality of nodes that contain credentials.
---
### Author:  [@knolleary](https://discourse.nodered.org/u/knolleary)
#### Post date: [2 October 2018 20:47 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/2 "2018-10-02T20:47:52Z")
We have no plans to provide an api that allows secure credentials to be exported from the editor. If we did that, then _anyone_ with access to the editor would be able to see all of the credentials. That would be a massive security issue.
The only way we'd consider this would be if we can find a way of approaching it that minimises the risk.
---
### Author:  [@jewendt](https://discourse.nodered.org/u/jewendt)
#### Post date: [2 October 2018 20:58 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/3 "2018-10-02T20:58:44Z")
Anyone with editor access already can see the credentials by double clicking on the node? I must be missing your point. I am not asking for an API that would unencrypt the \_cred file, I just want a way that I can share a common set of flows to multiple applications. For example, I am building an application that I want to deploy to 100's or distinct PI's. How am I supposed to do this without having to edit everyone of them and type back in all of the settings and credentials?
---
### Author:  [@dceejay](https://discourse.nodered.org/u/dceejay)
#### Post date: [2 October 2018 21:39 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/4 "2018-10-02T21:39:43Z")
No they can't - the \*\*\*\*\*\*\* that you see in the browser is not a disguised version of the password (or whatever) it's just a visual representation that you have filled something in... so cutting and pasting it won't help. The credentials only go from front to backend once on entry (or they do on nodes that are coded correctly).
---
### Author:  [@jewendt](https://discourse.nodered.org/u/jewendt)
#### Post date: [2 October 2018 22:30 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/5 "2018-10-02T22:30:27Z")
Hmm...not based upon the nodes that I am using. See attached.
---
### Author:  [@knolleary](https://discourse.nodered.org/u/knolleary)
#### Post date: [2 October 2018 22:45 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/6 "2018-10-02T22:45:33Z")
Looking at the blob storage node you are using, they have defined the inputs as `text` inputs rather than `password` inputs - so they are showing the value rather than hiding it. That's a bug with the node.
If you save the changes, deploy then reload the editor and re-open the edit dialog, you should see the values have all been replaced with ` __PWRD__ ` - which is the placeholder Dave mentioned in his reply.
---
### Author:  [@jewendt](https://discourse.nodered.org/u/jewendt)
#### Post date: [3 October 2018 00:55 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/7 "2018-10-03T00:55:18Z")
I purposely took a screen shot after deploy and reload. Every field in here gets removed when I try and export. Is this determined by the Node developer? Regardless, do you understand my request. If I want to deploy this to 100 different areas, I need to touch everyone to manually to add the information back in?
---
### Author:  [@tilleul](https://discourse.nodered.org/u/tilleul)
#### Post date: [3 October 2018 05:01 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/8 "2018-10-03T05:01:06Z")
I'm not sure, but doesn't it work if you copy the credentials file as well ?
---
### Author:  [@dceejay](https://discourse.nodered.org/u/dceejay)
#### Post date: [3 October 2018 08:59 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/9 "2018-10-03T08:59:31Z")
As Nick said - if they chose not to set at least the key as a password type field then I would call that a bug - but it's their choice.
---
### Author:  [@krzydec](https://discourse.nodered.org/u/krzydec)
#### Post date: [4 June 2020 14:36 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/10 "2020-06-04T14:36:09Z")
Hello.
jewendt:
Did you manage to solve this issue?
I'm facing the same problem. I will have to deploy and manage same flows on the multiple devices.
They will all share the same flow file loaded from the network location, but entering / updating credentials to connect to the sql server manually will be a pain.
I will appreciate suggestions how to overcome this.
---
### Author:  [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)
#### Post date: [4 June 2020 18:31 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/11 "2020-06-04T18:31:37Z")
Which node are you using for SQL server? If you use mssql-plus it saves credentials in the cred.json file.
---
### Author:  [@krzydec](https://discourse.nodered.org/u/krzydec)
#### Post date: [5 June 2020 10:50 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/12 "2020-06-05T10:50:01Z")
Hello.
I found some tips here:
[How to copy credentials in node-red flow?](https://discourse.nodered.org/t/how-to-copy-credentials-in-node-red-flow/23315/8)
and here:
[Node-RED User Directory](https://discourse.nodered.org/t/node-red-user-directory/25454)
My approach to solving this:
1. Create a copy of the `~/.node-red folder` on a network location
2. Modify `settings.js` file specifying `userDir:` to match location from step 1.
3. Modify `settings.js` file specifying `contextStorage` location:
```auto
contextStorage: {
default: {
module:"localfilesystem",
config: {
dir: "", // eg. "/home/pi/store/"
base: "", // eg. "context"
}
},
},
```
This allows to share flows and credentials between devices.
---
### Author:  [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)
#### Post date: [5 June 2020 11:30 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/13 "2020-06-05T11:30:34Z")
> [@krzydec](#):
>
> This allows to share flows and credentials between devices
Um, not really the same.
That's for setting up file based context storage.
From my understanding, when a node correctly implements credentials they get saved next to your flows file in xxx\_cred.json file.
That's why I asked what SQL server node you were using as the one I mentioned does this!
---
### Author:  [@GogoVega](https://discourse.nodered.org/u/GogoVega)
#### Post date: [7 December 2023 12:02 UTC](https://discourse.nodered.org/t/export-import-security-credentials/3637/14 "2023-12-07T12:02:10Z")
Hi Team,
Sorry to bring up an old topic but it's still relevant.
Has the question evolved? I know it's a wish but there are still questions about how to do it.
The link to the [discussion](https://github.com/node-red/designs/discussions/44).
What are the problematic points and can we think about them?
As NR v4 will have to use authentication, the API is secure. Concerning permissions, we should make a difference between a basic user and a user with privileges, so that the read permission has no access to credentials but a read+ permission yes.
Concerning encryption, exporting flows may require a password from the user (only for download because it is especially storage that represents a breach) and also to re-enter their password during import. Are credentials showed raw in the window allowing them to be copied directly?
The API part only, difficult to say, should we automatically create an encryption password as parameter in order to fetch the flow?