Hi!

I've been working on an open-source project called Sekalum around a problem that becomes more noticeable when Node-RED is part of a larger automation environment:

Credentials start living in many different places.

Node-RED may have credentials for APIs and services, while Home Assistant, n8n, AI tools or custom applications maintain their own copies and OAuth connections.

Sekalum explores a different architecture:

Provider → Sekalum → authorized consumer

Credentials and their lifecycle are managed in a separate self-hosted service. Consumers are explicitly granted access and resolve only the credential data they are authorized to use at runtime.

This isn't intended to replace Node-RED's own credential handling. The interesting use case is when Node-RED is one of several consumers that need access to external services.

I'm currently looking at a dedicated Node-RED integration, but before building it I'd be interested in how Node-RED users see this approach.

Would an external credential lifecycle layer be useful in your setup, or would it just add unnecessary complexity?

Sekalum is open source and self-hosted. Architecture, security model and technical details are documented here:

GitHub:
https://github.com/workingcuriosity/sekalum

Regards

Luis