Safe Account Deletion in n8n: What to Check Before Reassigning Workflows and Credentials

Why this matters

Deleting an account in a workflow automation platform like n8n touches both continuity and security. Workflows, credentials, triggers (webhooks), and integration tokens are often tightly coupled to a user identity; a naive transfer can leave dangling references, broken webhooks, or unintentionally preserved access. Taking a snapshot and exporting JSON is a good start, but it shouldn't be the only line of defense.

Key technical and operational checks

Before deletion, confirm whether tags, credential ownership, and workflow activation states are actually transferred by the platform (test on staging). Verify webhook endpoints and credentials: webhook URLs, OAuth refresh tokens, API keys, and encrypted credential blobs must be re-associated and - where feasible - rotated. Check for scheduled triggers and external integrations that may validate actor identity. Review any environment-level encryption key used to encrypt stored credentials; reassigning ownership without ensuring the decryption context can cause credentials to become unreadable.

Practical, actionable plan

1) Snapshot DB + export JSON (you already do this). 2) Move ownership in staging first and run full integration tests (webhooks, schedules, external API calls). 3) Rotate keys and secrets after successful testing. 4) Audit logs and record ownership changes. 5) Keep a short "soft delete" or disabled user window before permanent deletion to revert if issues surface.

Strategic recommendations for leaders

Treat user transition as a mini cutover: schedule downtime windows for critical workflows, require a checklist sign-off, and add automation that reassigns and tests workflows when users depart. Consider centralizing credentials in a secrets manager and minimizing credential ownership by individuals to reduce friction and risk during personnel changes.