# What is credentialSecret and how to set with multiuser enviroment?

**URL:** https://discourse.nodered.org/t/what-is-credentialsecret-and-how-to-set-with-multiuser-enviroment/35120
**Category:** General
**Created:** [31 October 2020 12:32 UTC](https://discourse.nodered.org/t/what-is-credentialsecret-and-how-to-set-with-multiuser-enviroment/35120 "2020-10-31T12:32:06Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![janainascal](https://avatars.discourse-cdn.com/v4/letter/j/f08c70/32.png) [@janainascal](https://discourse.nodered.org/u/janainascal)
#### Post date: [31 October 2020 12:32 UTC](https://discourse.nodered.org/t/what-is-credentialsecret-and-how-to-set-with-multiuser-enviroment/35120/1 "2020-10-31T12:32:07Z")

</div>

Hi there,

I'm testing around with NR on docker.  
From the docs ([Running under Docker](https://nodered.org/docs/getting-started/docker) and [User Guide: Securing Node Red](https://nodered.org/docs/user-guide/runtime/securing-node-red)) I'm confused about the settings property **credentialSecret**.

What is that? In my understanding it isn't a user password, is a default value used by NR

I come across with the **credentialSecret** property by reading about user credentials and how to set these. and the [docs](https://nodered.org/docs/getting-started/docker#credentials-secrets-and-environment-variables) says:

> Of course you never want to hard-code credentials anywhere, so if you need to use credentials with your Node-RED project, the above Dockerfile will let you have this in your `settings.js` …
> 
> `module.exports = { credentialSecret: process.env.NODE_RED_CREDENTIAL_SECRET // add exactly this }`
> 
> …and then when you run in Docker, you add an environment variable to your `run` command  
> `docker run -e "NODE_RED_CREDENTIAL_SECRET=your_secret_goes_here"`

But it not show an example of a `credentialSecret`. I'm guessing it is a password hash as described by the [docs](https://nodered.org/docs/user-guide/runtime/securing-node-red#generating-the-password-hash). In that case, setting multiples users is impossible.

So my other question is:  
Is possible to set multiples user throw environment variables? How so?

* * *

possible related discussions:  
[credentialsecret-flows-stopped-as-the-credentials-could-not-be-decrypted](https://discourse.nodered.org/t/solved-credentialsecret-flows-stopped-as-the-credentials-could-not-be-decrypted/19363)  
[how-to-set-credentialsecret-asynchronously](https://discourse.nodered.org/t/how-to-set-credentialsecret-asynchronously/33410)

---

<div class="post-metadata">

### Author: ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)
#### Post date: [31 October 2020 13:11 UTC](https://discourse.nodered.org/t/what-is-credentialsecret-and-how-to-set-with-multiuser-enviroment/35120/2 "2020-10-31T13:11:26Z")

</div>

Node-RED is not multiuser so this isn’t really a problem :-). @hardillb did post a series recently on how to create a basic multi-user setup using Docker where each user gets their own instance.

---

<div class="post-metadata">

### Author: ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)
#### Post date: [31 October 2020 13:22 UTC](https://discourse.nodered.org/t/what-is-credentialsecret-and-how-to-set-with-multiuser-enviroment/35120/3 "2020-10-31T13:22:33Z")

</div>

> [@janainascal](#):
>
> I'm confused about the settings property **credentialSecret**.
> 
> What is that? In my understanding it isn't a user password, is a default value used by NR

`credentialSecret` is nothing to do with user authentication.

It is the key used to encrypt the flow credentials file.

> [@janainascal](#):
>
> Is possible to set multiples user throw environment variables? How so?

Node-RED uses the `adminAuth` setting to configure user credentials. You would have to set it up in your settings file to get the user/password from environment variables.

[https://nodered.org/docs/user-guide/runtime/securing-node-red](https://nodered.org/docs/user-guide/runtime/securing-node-red)

But as Dave says, Node-RED is not multi tenent - the runtime runs one set of flows. If you have multiple users configured, they all see the same flows.

---

<div class="post-metadata">

### Author: ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)
#### Post date: [31 October 2020 14:04 UTC](https://discourse.nodered.org/t/what-is-credentialsecret-and-how-to-set-with-multiuser-enviroment/35120/4 "2020-10-31T14:04:17Z")

</div>

Link to the Multi Tenant instructions:

> **[Multi Tenant Node-RED](https://www.hardill.me.uk/wordpress/2020/10/01/multi-tenant-node-red/)**
>
> I was recently approached by a company that wanted to sponsor adding Multi Tenant support to Node-RED. This would be to enable multiple users to run independent flows on a single Node-RED instance.…

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)
#### Post date: [30 December 2020 14:04 UTC](https://discourse.nodered.org/t/what-is-credentialsecret-and-how-to-set-with-multiuser-enviroment/35120/5 "2020-12-30T14:04:20Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.
