Jenkins Credentials

Why a credentials store?

Never hardcode passwords, tokens, or API keys in a Jenkinsfile or Freestyle shell. Jenkins has a built-in Credentials Store so secrets stay out of Git and out of job config screenshots.

Add credentials

1. Manage Jenkins → Credentials → System → Global credentials
2. Add Credentials
3. Choose kind, set an ID you will reference in pipelines, then Create

Credential ID

The ID (for example dockerhub-credentials) is the stable name used in withCredentials and credentials('...'). Changing the secret later does not require editing the Jenkinsfile if the ID stays the same.

Types you need for Day 3

Docker Hub credentials (Project 3)

1. Add Credentials
2. Kind: Username with password
3. Username: your Docker Hub username
4. Password: Docker Hub password or access token
5. ID: dockerhub-credentials
6. Save

Using credentials in a Jenkinsfile

withCredentials (recommended scope)

withCredentials([usernamePassword(
  credentialsId: 'dockerhub-credentials',
  usernameVariable: 'DOCKER_USER',
  passwordVariable: 'DOCKER_PASS'
)]) {
  sh 'echo $DOCKER_PASS | docker login -u $DOCKER_USER --password-stdin'
}

Environment binding

environment {
  DOCKER_CREDS = credentials('dockerhub-credentials')
  // Creates DOCKER_CREDS_USR and DOCKER_CREDS_PSW
}

Day 4 expands this with SSH keys, secret files, rotation, and auditing.