---
credentials:
  litellm_api_key:
    description: Per-consumer virtual key for the shared svc-ai-litellm gateway
    algorithm: sk_prefixed
    validation:
      min_length: 50
  encryption_key:
    description: "AES encryption key n8n uses to encrypt stored credentials at rest. Must remain stable across deploys — changing it invalidates all saved credentials.
      A mismatch between the settings file and the env var makes oclif's findCommand throw for every command, so `n8n export:credentials` is unreachable in exactly
      the state that would need it and a re-key is one-way."
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{32,}$"
    length: 48
    rotatable: false
  owner_password:
    description: "Break-glass local password for the n8n owner account created during bootstrap. Alphanumeric on purpose — the system admin password carries special
      characters (e.g. Unicode, single quotes) that fail n8n's xssCheck on the /rest/owner/setup endpoint. Normal users authenticate via SSO/Keycloak; this password
      is only used for the one-time bootstrap and as a break-glass credential."
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{32,}$"
    length: 48
  mcp_token:
    description: "Bearer an MCP client must present to the managed MCP Server Trigger. Alphanumeric so it survives n8n's xssCheck on the workflow payload."
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{32,}$"
    length: 48