How to Audit Zapier, Make and n8n Credentials

No-code automation platforms hold OAuth grants and API keys for your CRM, mailboxes, finance systems and cloud accounts, usually created under an individual employee's identity and shared across a team without anyone tracking them. This guide is a step-by-step audit of connections and credentials in Zapier, Make and n8n: where each platform lists them, how to find owners, unused and over-scoped connections, what happens when the person who created them leaves, and how to clean up without stopping business workflows. It is for IT, SaaS administrators and identity teams who have inherited a sprawl of automations. Platform-specific hardening is covered in the Zapier AI Security Guide and the n8n Security Guide.

Key takeaways

Connections are machine identities wearing a person's badge: most connections authenticate as the employee who created them, so their access, and their departure, define the risk.
Leavers do not switch connections off: Zapier documents that when a member is removed, shared connections keep working as long as the user's app account exists or until they expire, and private connections can stay active for up to 30 days.
Team membership is credential access: Make states that anyone on a team can use and manage connections created in that team.
Self-hosted n8n holds the keys locally: credentials are encrypted with a key kept in the ~/.n8n folder or N8N_ENCRYPTION_KEY, and n8n export:credentials --decrypted writes them out in plain text.
Each platform gives you an unused-credential signal: Zapier shows Zap counts per connection, Make lists scenarios per connection, and the n8n security audit flags credentials not used in any, any active or any recently active workflow.

When you need this

SaaS or shadow automation discovery: automations are often the first place business teams connect production systems without IT review. See the Shadow SaaS and Unsanctioned App Discovery Guide.
Leavers and team changes: to find connections still authenticating as former staff and move them to owned service accounts.
Before adding AI steps or agents: AI actions inside automations can call any connected app, so over-scoped connections become agent permissions.
After a token or key exposure in a connected app: to find every automation that used the affected credential and reconnect it.
Periodic NHI access review: automation connections belong in the same certification as service accounts and OAuth apps. See the SaaS and OAuth App Governance Guide.

Before you start

Admin access on each platform: Zapier account owner or admin on a Team or Enterprise plan; Make organisation or team admin; n8n instance owner (the n8n security audit API requires the instance owner).
Your identity provider and SaaS logs: to see which OAuth grants exist on the other side, for example in Google Workspace, Microsoft Entra or Salesforce.
HR leaver list: at least 12 months of leavers to match against connection owners.
A safe place for n8n output: the audit never needs decrypted credentials, but backups might contain them; agree where reports are stored.
A findings register: platform, connection or credential name, app, owner, account it authenticates as, auth type (OAuth or API key), automations using it, last activity, decision.

Step-by-step

1. Know where each platform lists credentials

Platform	Where to look	What it shows	Unused signal
Zapier	App Connections page (`zapier.com/app/assets/connections`), tabs Connections and Apps	Connection name, app, number of Zaps using it, last modified, who it is shared with; filters for status (active, expired, non-compliant), app and owner	Zap count of zero; expired status
Make	Left sidebar Credentials > Connections	Scenarios using each connection, permissions granted, creator; filter All connections or My connections	No scenarios listed
n8n	Credentials list per project; `n8n audit` or `POST /audit`; the n8n node Audit resource	Credentials report plus Database, File system, Nodes and Instance reports	Not used in any workflow, in an active workflow, or in a recently active workflow

2. Zapier: inventory connections

Open App Connections and set the dropdown to All connections. Export or record every connection with app, owner, Zap count, last modified and sharing.
Use Filters to list expired and non-compliant connections first; these are the quickest cleanup.
Switch to the Apps tab to see, per app, how many connections exist, how many have expired, how many Zaps use them and which users own them. Apps with many connections usually mean the same system has been connected by several people with personal accounts.
For each connection to a sensitive app (email, file storage, CRM, finance, cloud, code hosting), record which account on the app side it authenticates as. A connection named after a person is a finding.
Look for connections renamed to the pattern X - connection name. Zapier applies that naming when ownership transfers from a removed member, so these are leaver connections still in use.

3. Make: inventory connections

In each team, open Credentials > Connections and set the filter to all connections.
For each connection, open the scenarios icon to list where it is used and the permissions icon to see what was granted.
Click Verify to check it still works. Make shows a green check mark for working connections and an exclamation mark for broken ones.
Record the team: because anyone on a team can use and manage its connections, a connection to a sensitive system in a large team is a broad grant. Make suggests a separate team for personal connections on the Teams plan or higher.
Note connections used by the Make an API call module; Make highlights scopes as most important there, so these often carry broad scopes.

4. n8n: run the security audit and review sharing

Run n8n audit on the server (prefix with docker exec -u node -it <container> for Docker), or call POST /audit as the instance owner.
From the Credentials report, list credentials not used in any workflow, not used in an active workflow, and not used in a recently active workflow.
Review sharing: n8n gives sharees a Can use role that lets them run and publish workflows with a credential but not see or edit its details; instance owners and admins can view and share all credentials. List who holds owner and admin roles.
Check whether credentials use external secrets (an Enterprise feature) through expressions such as {{ $secrets.<vault-name>.<secret-name> }}; those are rotated in the vault, not in n8n.
For self-hosted instances, confirm how the encryption key is set (N8N_ENCRYPTION_KEY or the generated key in ~/.n8n), that it is set on every worker in queue mode, and who can read it.
Search backup jobs and scripts for export:credentials --decrypted. n8n warns that with decrypted export all sensitive information is visible in the files.

5. Cross-check from the connected apps

Platform views show what the platform knows. Confirm from the other side: list OAuth grants to Zapier, Make and n8n client applications in your identity provider and key SaaS admin consoles, and API keys issued to integration accounts. Grants that exist in the app but not in any platform list are orphaned and can be revoked at the source. See the Consent Phishing and Illicit OAuth Grants Guide.

6. Decide

Finding	Decision	Notes
No automations use it	Delete, then revoke at the app	Zapier allows bulk Delete selected for up to 100 connections
Authenticates as a leaver	Reconnect with a service account, then revoke the leaver's grant	Owner must reconnect; Zapier reconnect works only for connections you own
Personal account on a business-critical system	Move to a dedicated integration account	Gives you an identity you can monitor and rotate
Broad scopes for a narrow task	Recreate with minimal scopes	Make notes modules fail if scopes are missing, so test
Shared widely	Reduce sharing or move to a restricted team or project	Stopping a Zapier share pauses published Zaps that rely on it

Verify it worked

Metric	Source	Target
Connections with zero automations	Zapier Zap count, Make scenarios list, n8n audit	Zero after cleanup
Connections authenticating as leavers	Register joined with HR list	Zero
Sensitive-app connections on personal accounts	Register	Falling each quarter
Expired or broken connections	Zapier status filter, Make Verify	Zero, or fixed within a week
Orphaned OAuth grants at the app side	Identity provider and SaaS consoles	Zero

After changes, run a test on each reconnected automation (Zapier Test connection, Make Verify, an n8n manual execution) and re-run n8n audit to confirm the unused list is empty.

Rollback and common errors

Deleting before revoking or the reverse: deleting a Zapier or Make connection does not necessarily revoke the token at the app, and revoking at the app first breaks automations. Order: replace, test, delete in the platform, revoke at the app.
Losing the original credential on edit: Make states it does not keep the original connection data when you edit, so you must re-enter all required credentials. Have them ready or create a new connection instead.
Deleting a Make connection used by webhooks: webhooks using the connection must be deleted first, and scenarios using it may stop.
Breaking Zapier webhooks during member removal: Zapier notes that Catch Hook and Catch Raw Hook URLs change when ownership transfers, so external systems need updating.
Changing the n8n encryption key: credentials are encrypted with it; set the key deliberately and back it up securely before any migration.
Treating removal as offboarding: in Zapier, shared connections from a removed member can keep working while the user's app account exists. Disable the app account or revoke the grant as well.

Hardening afterwards

Use integration accounts: create a dedicated, owned account per platform for connections to business systems, with MFA and a named team owner.
Segment by team or project: keep sensitive connections in small Make teams or n8n projects and share in Zapier only with the people who need them.
Use external secrets on n8n: store API keys in your secrets manager and reference them, so rotation happens in one place. See the Secrets Management Guide.
Protect self-hosted n8n: restrict who can run CLI commands and read ~/.n8n, and keep decrypted exports out of backups.
Add platforms to offboarding: check connection ownership in Zapier, Make and n8n for every leaver. See the Employee Offboarding Security Guide.
Schedule the audit: run n8n audit and review Zapier and Make connection lists quarterly.

Framework	Reference	Relevance
NIST CSF 2.0	ID.AM-02, PR.AA-01, PR.AA-05	Software and service inventory, managed credentials, reviewed least-privilege access
NIST SP 800-53 Rev 5	AC-2, AC-6, IA-5, CM-7	Account review, least privilege, authenticators, least functionality
CIS Controls v8.1	Controls 2, 5 and 6	Software inventory, account and access control management
ISO/IEC 27001:2022 Annex A	A.5.17, A.5.18, A.5.23	Authentication information, access rights, use of cloud services
MITRE ATT&CK	T1528, T1550.001	Theft and use of application access tokens

Practitioner checklist

Export every connection and credential from Zapier, Make and n8n into one register.
Record the account each connection authenticates as and match owners against leavers.
Delete connections with no automations and revoke their grants at the connected app.
Reconnect leaver and personal-account connections with owned integration accounts.
Recreate over-scoped connections with minimal scopes and test them.
Run n8n audit, review credential sharing and the encryption key, and remove decrypted exports.
Cross-check OAuth grants and API keys from the identity provider and key SaaS consoles.
Add automation platforms to offboarding and schedule a quarterly review.

How to audit Zapier, Make and n8n connections and credentials: owners, scopes and cleanup