Credentials And Auth

Ops team rotates N8N_ENCRYPTION_KEY in the docker-compose env without re-encrypting existing credentials. All workflows fail with 'cannot decrypt credential'.

Rotation is a two-step playbook: run `n8n executeBatch --re-encrypt` (or the documented re-encryption procedure) with both old and new keys configured BEFORE removing the old key. Test on a staging instance. Back up the DB first.

Operator registers an OAuth2 app at the vendor with redirect https://localhost:5678/rest/oauth2-credential/callback for dev, then ships to prod at https://n8n.acme.com without updating the vendor.

Register the production callback URL (https://<instance>/rest/oauth2-credential/callback) at the vendor before promoting. n8n shows the exact URL to register in the credential UI. Keep dev + prod as separate OAuth apps so rotating one doesn't bleed into the other.

Operator requests `https://www.googleapis.com/auth/drive` (full Drive access) when the workflow only needs to download one shared folder.

Pick the narrowest scope that satisfies the use case (`drive.readonly` or `drive.file`). Document scopes per workflow. Re-consent users when scopes change — silent scope expansion is a breach of trust.