The Credentials Store
Jenkins stores secrets like passwords, tokens, and SSH keys securely so pipelines can use them without exposing them.
The credentials store is Jenkins' secure vault for secrets: passwords, API tokens, SSH keys, and certificates. Pipelines reference a secret by its ID and never see the raw value in plain text.
Credential types
- Username & password — for registries, databases, etc.
- Secret text — a single token or API key.
- SSH username with private key — for Git over SSH.
- Secret file — an entire file, like a kubeconfig.
Scopes
Credentials can be global (usable anywhere) or scoped to a specific folder so only certain jobs can use them.
Example
# Manage Jenkins > Credentials > System > Global > Add Credentials
#
# Kind: Username with password
# ID: dockerhub-login <-- referenced from the pipeline
# Username: myuser
# Password: ********
#
# The raw password is encrypted and never shown again.When to use it
- A pipeline retrieves a Docker Hub password from the Jenkins credential store instead of hard-coding it in the Jenkinsfile.
- An SSH private key for deploying to a production server is stored in Jenkins so the key never appears in source code.
- A team stores an AWS access key pair as a credentials binding so it is automatically masked in console output.
More examples
Add secret text credential via CLI
Creates a secret text credential named npm-token in the global Jenkins credentials store via the CLI.
# Use the Jenkins CLI to create a secret text credential
java -jar jenkins-cli.jar \
-s http://localhost:8080 \
-auth admin:$TOKEN \
create-credentials-by-xml \
system::system::jenkins _ <<'EOF'
<org.jenkinsci.plugins.plaincredentials.impl.StringCredentialsImpl>
<id>npm-token</id>
<description>NPM publish token</description>
<secret>YOUR_TOKEN</secret>
</org.jenkinsci.plugins.plaincredentials.impl.StringCredentialsImpl>
EOFList credentials via REST API
Lists all credentials in the global domain of the Jenkins credentials store via the REST API.
curl -s \
'http://localhost:8080/credentials/store/system/domain/_/api/json?pretty=true' \
--user admin:$TOKENReference credential in pipeline
Binds the npm-token credential to an environment variable so npm publish can authenticate without exposing the token.
pipeline {
agent any
environment {
NPM_TOKEN = credentials('npm-token')
}
stages {
stage('Publish') {
steps {
sh 'echo //registry.npmjs.org/:_authToken=$NPM_TOKEN >> .npmrc'
sh 'npm publish'
}
}
}
}
Discussion