n8n Credentials Expired — How to Fix It Before Your Workflows Go Silent

A credential expiry is one of the few outages you could have circled on a calendar weeks ago. The token had a known lifespan. The clock was running the whole time. And still, the morning it dies, it always feels like a surprise.

That gap is the entire problem, and it is the reason you are probably here. The expiry was predictable. The silence that followed was not. A Google OAuth token gives out after six months of quiet. A provider rotates an API key on its own schedule. Nothing about the timing is mysterious. What is mysterious is why nobody got told. Priya, who runs a 4-person agency on n8n, Make, and Zapier, learned about a dead token the way most operators do: a client message before coffee, a Google Sheets sync that had run clean for four months sitting silent since 2am, and a log stacked with identical 401s nobody had looked at.

If you are staring at a 401 or a workflow that just went quiet, you are almost certainly looking at an expired credential. The good news is the fix is fast. Here is where to start.

The fastest fix: reconnect the credential directly

Open your n8n instance, go to Settings, Credentials, and find the connection that matches the failing node. Click into it. Hit reconnect or re-authorize. For OAuth connections like Google, Slack, or HubSpot, this opens a browser prompt asking you to log back in and grant access again. Do it. Save. Then go back to the failing workflow and confirm the node still points at the refreshed credential, because n8n sometimes loses that link after a reconnect. Run one manual test execution to be sure.

No reconnect button? Working with a static API key instead of OAuth? Generate a fresh key in the source app and paste it into n8n by hand. The full key-rotation pattern, including how to audit which workflows the dead key touched, is in API Key Expired and Automation Stopped.

5 reasons n8n credentials break

“Authorization is performed, running requests until the token expires. After expiring I’m getting a 401 error.”

— woodyalan on n8n Community Forum, 2022-02-07

That forum post is twelve words of the same story everyone tells. The token works, then it doesn’t, and the only signal is a number in a log. Here are the five shapes that number takes.

1. The OAuth refresh token expired. The workflow dies on the first node with a 401 or an “access token expired” message. It ran yesterday. Nothing changed in your code. Open the failing node’s credential settings and look at the connection status. The thing to understand: OAuth has two layers, a short-lived access token n8n renews on its own, and a long-lived refresh token it cannot. That refresh token gives out after roughly six months of inactivity, or the moment a user revokes app access. Once it is gone, n8n has no way to heal itself. You reconnect, or it stays dead.

2. The upstream provider rotated the key. Watch for this one: several workflows failing at the same minute, all hitting the same service, all on the same date, with zero changes on your side. That pattern is a rotated key, not a coincidence.

“I had an active n8n API key per environment which worked just fine and was used at least once a day. But just now (starting Feb 19.) the API keys all expired at once.”

— octionic on n8n Community Forum, 2025-02-19

Log into the source app and check the key status. Providers invalidate keys after security events or on a rotation schedule, and every workflow sharing that key falls over instantly with no warning from anyone. The alert you want is not Error 401: Unauthorized. It is something a human can act on: “The Google Sheets credential in workflow Client CRM Sync is returning 401, the key may have been rotated in Google Cloud Console.” One of those tells you what broke. The other tells you a number.

3. The credential field got mangled by a version update. This is the quiet one. The credential worked before a recent n8n upgrade and now throws a validation error even though the token still looks correct in the panel. Open the credential in Settings, Credentials and re-save it without touching a single field. n8n stores credentials encrypted, and a major upgrade occasionally shifts the storage format underneath, leaving older fields in a shape the updated nodes no longer read. The re-save rewrites them into the new format. Then run a test execution to confirm.

4. One shared credential, one revocation, everything down. Several workflows fail at once, across different clients, all riding the same underlying connection. Open the credential in Settings, Credentials and read the “Used in” section. If a single connection is powering eight workflows across three client accounts, one revocation takes all eight offline in the same instant. Agencies reuse credentials to save setup time. It works beautifully right up until it collapses everything together.

5. A service-side IP block. The credential reauthorizes cleanly, test runs pass, and live executions still keep failing with connection or rate-limit errors. The credential is fine. The source system is refusing connections from your server’s address. This shows up most often right after you migrate n8n to a new host and forget to add the new IP to the API’s allowlist. Check whether your instance’s outbound IP got flagged before you go tearing the credential apart, because the credential was never the problem.

The gap that keeps catching agencies

Reconnecting gets Priya’s workflow running again in minutes. The thing that does not get fixed in minutes is how she found out: from the client, not from her own setup. Expired credentials fail in total silence. No email, no flag, just 401s stacking up in a log nobody was reading. For the wider version of closing that gap, see My Automation Broke and I Don’t Know Why and How to Prevent Silent Automation Failures.

The calendar part you can already solve with a spreadsheet and a 90-day reminder. The silence is the part a spreadsheet cannot fix. NoCrash watches your n8n workflows from the outside and tells you in plain language the moment one goes quiet, the same morning the token dies, not the afternoon a client emails. Connect your first workflow free at nocrash.io and you will read about the dead token in tomorrow’s brief instead of from your client.

The only question left is the boring one: who finds out first when a credential dies, you or the people paying you?