n8n Credentials and Security Non-negotiables 1. Secrets via the credential system, never in text fields or SDK code. API keys, bearer tokens, OAuth secrets, passwords: all go through or the node's parameter. A Set node hardcoding a token and read via is a text field with extra steps. 2. List credentials, then bind by ID. Call before configuring an auth-needing node. One match: bind via 2-arg at create time, or op on . Multiple matches: ask the user which. The one-arg is a placeholder; n8n auto-assigns the most recently edited credential of that type and silently picks wrong when the user has…