# Node-RED Projects and Credentials Encryption in DevOps Pipeline

**URL:** <https://discourse.nodered.org/t/node-red-projects-and-credentials-encryption-in-devops-pipeline/101141>\
**Category:** General\
**Tags:** docker\
**Created:** [27 May 2026 12:37 UTC](https://discourse.nodered.org/t/node-red-projects-and-credentials-encryption-in-devops-pipeline/101141 "2026-05-27T12:37:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![aitor](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/aitor/32/97363_2.png) [@aitor](https://discourse.nodered.org/u/aitor)\
**Post date:** [27 May 2026 12:37 UTC](https://discourse.nodered.org/t/node-red-projects-and-credentials-encryption-in-devops-pipeline/101141/1 "2026-05-27T12:37:35Z")

</div>

Hi,

I'm having trouble with Node-RED projects and credential encryption.

Context of my setup:

- Development is done in a Dockerized Node-RED instance with Projects (git) enabled.
- When I commit code, it is pushed to a GitHub repository.
- A GitHub Action builds a new container using a Dockerfile plus the flows and project files.
- The image is pushed to Docker Hub.
- The OPS server then pulls this image and redeploys the containers.

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/1/c/1ca92474399afea5ac0f3be35b3a1bb95616ac01.png)

The problem is with `flows_cred.json`. When encryption is enabled, the container generated in the pipeline cannot decrypt the credentials.

I tried setting the `credentialSecret` in `settings.js`, but it did not work.

If I disable encryption, everything works fine, but that is not the desired setup.

How should this be configured correctly so encrypted credentials can be used across environments?

Thanks!

(Node-RED 4.0.2)

---

<div class="post-metadata">

**Author:** ![greengolfer](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/greengolfer/32/28276_2.png) [@greengolfer](https://discourse.nodered.org/u/greengolfer)\
**Post date:** [27 May 2026 17:23 UTC](https://discourse.nodered.org/t/node-red-projects-and-credentials-encryption-in-devops-pipeline/101141/2 "2026-05-27T17:23:55Z")

</div>

I have a similar use case. However, as the container I am getting from the repo can be used the fetch information from many different MQTT brokers, I am using env variables, initiated as the start of the container to configure all brokers (url, user, passed, topic, qos…).  
So flows\_cred is empty… maybe not applicable to your situation, though.

---

<div class="post-metadata">

**Author:** ![nlecaude](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/nlecaude/32/25_2.png) [@nlecaude](https://discourse.nodered.org/u/nlecaude)\
**Post date:** [27 May 2026 18:30 UTC](https://discourse.nodered.org/t/node-red-projects-and-credentials-encryption-in-devops-pipeline/101141/3 "2026-05-27T18:30:14Z")

</div>

I'm surprised when you say setting the credential Secret in settings.js doesn't work as we have a very similar setup and it works on our side. When you first setup the Node-RED project, are you using the same credential secret as in your settings.js file ? When using projects the credentialSecret is stored in the .config.projects.json file and should be the same as the one defined in your settings file.

---

<div class="post-metadata">

**Author:** ![aitor](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/aitor/32/97363_2.png) [@aitor](https://discourse.nodered.org/u/aitor)\
**Post date:** [29 May 2026 10:22 UTC](https://discourse.nodered.org/t/node-red-projects-and-credentials-encryption-in-devops-pipeline/101141/4 "2026-05-29T10:22:19Z")

</div>

Thanks @greengolfer and @nlecaude.

It’s now fixed. The key point is that the order of the steps matters:

1. Configure `credentialSecret` in `settings.js`.
2. Create the project using that existing `credentialSecret` for encryption.

When done strictly in this sequence, everything works correctly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [12 June 2026 10:22 UTC](https://discourse.nodered.org/t/node-red-projects-and-credentials-encryption-in-devops-pipeline/101141/5 "2026-06-12T10:22:31Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.