How to Get Your N8N API Key (Self-Hosted and Cloud)

The N8N API key is how external tools talk to your N8N instance without clicking through the UI. It's also the only thing standing between you and a 401 Unauthorized error when you try to deploy a workflow via curl.

Three clicks to generate it. Zero clicks if you miss the copy window — you'll have to delete and regenerate. The key is displayed exactly once, which is either excellent security practice or a deliberate attempt to keep you humble. Probably both.

Why you need the API key

N8N exposes a REST API that lets you import workflows, activate them, and update credentials without touching the UI. This is how automated deployments work — a single curl command pushes your workflow JSON directly into your N8N instance in about four seconds.

Without the API key, that command returns 401 Unauthorized. With it, you can deploy, activate, and verify a workflow from the command line. The key is also used if you want to trigger workflows externally, list executions, or update credentials programmatically.

It's the front door to everything N8N exposes outside its own interface. If you're following the self-hosted VPS setup guide, you'll need this key before any of the deployment steps work.

Generate the key: self-hosted VPS

If you deployed N8N using the Hostinger VPS N8N template, your instance is running and accessible. Here's the path to your key:

1. Open your N8N dashboard in a browser and log in. If this is your first visit, N8N will prompt you to create an owner account first.
2. In the bottom-left corner, click the gear icon — that's Settings.
3. In the left settings menu, click n8n API.
4. Click Create an API Key. Give it a label — deploy-agent or aiip-workflows works fine. Click Save.
5. Copy the key immediately. N8N displays it exactly once. After you close or refresh, only the label is visible — the value is gone from the UI. N8N stores only a hashed version of the key, not the raw string. Think of it like a bank sending you a one-time PIN. Paste it somewhere safe before clicking away.

Your API base URL for this instance is:

https://your-n8n-domain.com/api/v1

Replace your-n8n-domain.com with the domain your N8N is served on. On a fresh Hostinger VPS before you configure a custom domain, it looks like:

https://n8n.srv857441.hstgr.cloud/api/v1

Once you've pointed a custom domain and set N8N_HOST in your docker-compose.yml, use that domain instead.

The greyed-out button fix

N8N community edition allows exactly one API key per instance. If the "Create an API Key" button is disabled, a key already exists.

Click the trash icon next to the existing key to delete it, then click Create. The old key stops working the moment it's deleted — update any tools or scripts that used it before you proceed. This is not the kind of thing you want to discover at 11pm when a deployment is running.

Encryption key vs. API key

These two things have confusingly similar names. They are completely unrelated systems.

N8N_ENCRYPTION_KEY is a server-side environment variable in your /root/docker-compose.yml. It encrypts the credentials stored in N8N's internal database — your Supabase API keys, Facebook tokens, Anthropic keys, everything. It's set once at install time and never changes. You never pass it in an API request. You never see it in the N8N UI. It is the lock on the vault.

N8N API key is a token you generate in the N8N UI under Settings → n8n API. It authenticates REST API requests from external tools. You pass it as the X-N8N-API-KEY request header. It can be rotated anytime. It is the key to the front door.

If you're deploying workflows via curl and getting authentication errors: you need the API key, not the encryption key. If your credentials suddenly stopped working after a server move: you might need to check the encryption key. Different problems, different fixes.

N8N Cloud

N8N Cloud is the managed version — no server required. Plans start at €20/mo (2,500 executions) and rise to €50/mo (10,000 executions). The path to generate an API key is identical to self-hosted: Settings → n8n API → Create an API Key, same one-time display.

Your API base URL on N8N Cloud is:

https://[your-instance].app.n8n.cloud/api/v1

One important difference: N8N Cloud uses {{ $vars.VARIABLE_NAME }} to reference variables in workflows, not {{ $env.VARIABLE_NAME }}. If you're running workflows built for a self-hosted instance, swap those references. The AIIP social agent templates are built for the self-hosted $env approach.

N8N Cloud is the right choice if you'd rather not manage a server. It's not the right choice if your workflows hit execution limits or if you need data to stay on your own infrastructure. If you're unsure which fits your situation, the intake form is the right place to start that conversation.

Using the key in curl

Once you have the key, deploying a workflow is a single command:

curl -X POST "https://your-n8n-domain.com/api/v1/workflows"   -H "X-N8N-API-KEY: YOUR_API_KEY"   -H "Content-Type: application/json"   -d @workflow-main.json

The -d @workflow-main.json flag reads the workflow JSON from a local file. The response includes the new workflow's id. Use that ID to activate it:

curl -X POST "https://your-n8n-domain.com/api/v1/workflows/WORKFLOW_ID/activate"   -H "X-N8N-API-KEY: YOUR_API_KEY"

Before deploying, run a quick connectivity test. If this returns a JSON array, your key and base URL are both correct:

curl "https://your-n8n-domain.com/api/v1/workflows"   -H "X-N8N-API-KEY: YOUR_API_KEY"

A 200 OK with JSON means you're clear. A 401 means the key is wrong. A connection refused error means the domain or URL is wrong. Fix the right thing.

The full N8N REST API documentation covers every available endpoint. For environment variable reference, the N8N configuration methods guide covers self-hosted setup in detail.

Keep it private

The N8N API key grants full access to your instance — create, modify, delete workflows and credentials. Treat it like a database password.

• Store it in a .env file alongside your docker-compose.yml, never hardcoded in scripts
• Add .env to your .gitignore before the first commit — not after
• Never paste it into Slack, Discord, or a support chat. If it ends up in a chat, rotate it immediately
• Rotate it after any team member with access leaves — there's no expiry date, so this is a deliberate habit, not an automatic process
• N8N community edition allows one key per instance. If you suspect compromise, delete and regenerate. The old key is invalidated the moment it's deleted

Once the key is set up, the next step in the AIIP social agent configuration is finding your Systeme.io tag IDs — the numeric IDs your N8N workflows use to tag contacts in your CRM.

Not ready to configure this yourself? The AI-Ready Business Blueprint includes the full technical setup — N8N, Supabase, Systeme.io, and the workflow deployment — handled across 8 sessions. Book a call to see if it's the right fit.