# Where are node config token/secrets/API keys stored

**URL:** <https://discourse.nodered.org/t/where-are-node-config-token-secrets-api-keys-stored/53759>\
**Category:** General\
**Created:** [15 November 2021 10:26 UTC](https://discourse.nodered.org/t/where-are-node-config-token-secrets-api-keys-stored/53759 "2021-11-15T10:26:39Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![cymplecy](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/cymplecy/32/2773_2.png) [@cymplecy](https://discourse.nodered.org/u/cymplecy)\
**Post date:** [15 November 2021 10:26 UTC](https://discourse.nodered.org/t/where-are-node-config-token-secrets-api-keys-stored/53759/1 "2021-11-15T10:26:39Z")

</div>

Excuse my ignorance but I was wondering where these are stored in a normal Pi install

I know that wherever that are they are stored encrypted and I assumed they were in the main flows.json file but I'm struggling to see where?

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [15 November 2021 10:41 UTC](https://discourse.nodered.org/t/where-are-node-config-token-secrets-api-keys-stored/53759/2 "2021-11-15T10:41:38Z")

</div>

They are in the cred file with a similar name to the flows file. Typically `flows_xxx_cred.json` or `flows_cred.json`

---

<div class="post-metadata">

**Author:** ![cymplecy](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/cymplecy/32/2773_2.png) [@cymplecy](https://discourse.nodered.org/u/cymplecy)\
**Post date:** [15 November 2021 10:52 UTC](https://discourse.nodered.org/t/where-are-node-config-token-secrets-api-keys-stored/53759/3 "2021-11-15T10:52:09Z")

</div>

Ok.

I saw that but I was expecting to see something like  
twitter config secret : LOADOFENCYPEDDATA  
twitter config token: MOREENCRYPTED  
etc

but it's the contents of that file a load of JSON that is encrypted?  
and that's why I can't scan it with my eyes?

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [15 November 2021 10:53 UTC](https://discourse.nodered.org/t/where-are-node-config-token-secrets-api-keys-stored/53759/4 "2021-11-15T10:53:17Z")

</div>

Yes, I believe the whole file is encrypted.

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [15 November 2021 10:54 UTC](https://discourse.nodered.org/t/where-are-node-config-token-secrets-api-keys-stored/53759/5 "2021-11-15T10:54:39Z")

</div>

> **[Viewing Node-RED Credentials](https://www.hardill.me.uk/wordpress/2021/02/17/viewing-node-red-credentials/)**
>
> A question popped up on the Node-RED Slack yesterday asking how to recover an entry from the credentials file. Background The credentials file can normally be found in the Node-RED userDir, which d…

---

<div class="post-metadata">

**Author:** ![cymplecy](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/cymplecy/32/2773_2.png) [@cymplecy](https://discourse.nodered.org/u/cymplecy)\
**Post date:** [15 November 2021 11:05 UTC](https://discourse.nodered.org/t/where-are-node-config-token-secrets-api-keys-stored/53759/6 "2021-11-15T11:05:10Z")

</div>

Thank you both

My knowledge of the great circle of credentials is complete 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [29 November 2021 11:05 UTC](https://discourse.nodered.org/t/where-are-node-config-token-secrets-api-keys-stored/53759/7 "2021-11-29T11:05:31Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.