# Jenkins credential add/create, obfuscate in logs and clean/remove within build pipeline run

**URL:** <https://community.jenkins.io/t/jenkins-credential-add-create-obfuscate-in-logs-and-clean-remove-within-build-pipeline-run/33443>\
**Category:** Ask a question\
**Tags:** question, pipeline\
**Created:** [July 2, 2025, 1:32pm UTC](https://community.jenkins.io/t/jenkins-credential-add-create-obfuscate-in-logs-and-clean-remove-within-build-pipeline-run/33443 "2025-07-02T13:32:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mkarwin\_atos](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/mkarwin_atos/32/3366_2.png) [@mkarwin\_atos](https://community.jenkins.io/u/mkarwin_atos)\
**Post date:** [July 2, 2025, 1:32pm UTC](https://community.jenkins.io/t/jenkins-credential-add-create-obfuscate-in-logs-and-clean-remove-within-build-pipeline-run/33443/1 "2025-07-02T13:32:20Z")

</div>

How can I compute a credential at run time and add it to Jenkins credentials store (to be used later in the code with credentialsId reference)? How can I clean it from within pipeline workflow once no longer needed? This is specifically for a use-case of:

1. have centrally-managed authentication solution with OIDC, such as Keycloak,
2. use Keycloak service account credentials stored in Jenkins at folder level,
3. use artifact storage solution that exchanges temporary identity token from Keycloak for an access token to such storage solution (this can be managed with cURL calls in shell script or [HttpURLConnection class](https://docs.oracle.com/javase/8/docs/api/java/net/HttpURLConnection.html) in direct Java/Groovy code implementation - that’s kind of easy to implement),
4. configure a new temporary credential on folder level (or better yet this build only) scope into Jenkins credential store from within pipeline code to be used interchangeably with older/hard-coded credentials logic to access artifact storage,
5. guarantee that newly created access token is not exposed by Jenkins build/run logs same as for credentials processed with withCredentials() block,
6. clean/remove such credential after the operations for which the token was retrieved are complete.

Using: linux docker container of [index.docker.io/jenkins/jenkins:2.504.2-lts](http://index.docker.io/jenkins/jenkins:2.504.2-lts)

Jenkins setup:  
Jenkins: 2.504.2  
OS: Linux - 5.14.0-427.28.1.el9\_4.x86\_64  
Java: 21.0.7 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)  
Plugins:

- Office-365-Connector:5.1.0
- analysis-model-api:13.2.0
- ansicolor:1.0.6
- ant:513.vde9e7b\_a\_0da\_0f
- antisamy-markup-formatter:173.v680e3a\_b\_69ff3
- apache-httpcomponents-client-4-api:4.5.14-269.vfa\_2321039a\_83
- apache-httpcomponents-client-5-api:5.5-150.veb\_76e719855b\_
- artifactory:4.0.8
- asm-api:9.8-135.vb\_2239d08ee90
- audit-trail:395.vce180b\_359a\_b\_5
- authentication-tokens:1.131.v7199556c3004
- badge:2.8
- basic-branch-build-strategies:228.v68c089762a\_db\_
- bitbucket-filter-project-trait:1.0
- bitbucket-oauth:0.14
- bitbucket-scm-filter-aged-refs:59.vc6b\_39c26988c
- bitbucket-scm-filter-jira-validator:0.1.0
- bitbucket-scm-trait-commit-skip:0.4.0
- blueocean:1.27.20
- blueocean-autofavorite:1.2.5
- blueocean-bitbucket-pipeline:1.27.20
- blueocean-commons:1.27.20
- blueocean-config:1.27.20
- blueocean-core-js:1.27.20
- blueocean-dashboard:1.27.20
- blueocean-display-url:2.4.4
- blueocean-events:1.27.20
- blueocean-git-pipeline:1.27.20
- blueocean-github-pipeline:1.27.20
- blueocean-i18n:1.27.20
- blueocean-jira:1.27.20
- blueocean-jwt:1.27.20
- blueocean-personalization:1.27.20
- blueocean-pipeline-api-impl:1.27.20
- blueocean-pipeline-editor:1.27.20
- blueocean-pipeline-scm-api:1.27.20
- blueocean-rest:1.27.20
- blueocean-rest-impl:1.27.20
- blueocean-web:1.27.20
- bootstrap5-api:5.3.5-1
- bouncycastle-api:2.30.1.80-261.v00c0e2618ec3
- branch-api:2.1217.v43d8b\_b\_d8b\_2c7
- build-timestamp:1.1.0
- caffeine-api:3.2.0-166.v72a\_6d74b\_870f
- checks-api:370.vb\_61a\_c57328f3
- cloudbees-bitbucket-branch-source:936.4.0
- cloudbees-disk-usage-simple:241.v0ea\_d9a\_a\_96ee8
- cloudbees-folder:6.1023.v4fcb\_72152519
- command-launcher:123.v37cfdc92ef67
- commons-collections4-api:4.5.0-8.va\_d5448ef9011
- commons-compress-api:1.27.1-3
- commons-lang3-api:3.17.0-87.v5cf526e63b\_8b\_
- commons-text-api:1.13.1-176.v74d88f22034b\_
- config-file-provider:988.v0461fcc2b\_9d1
- configuration-as-code:1971.vf9280461ea\_89
- conventional-commits:0.11.2
- credentials:1415.v831096eb\_5534
- credentials-binding:687.v619cb\_15e923f
- data-tables-api:2.2.2-1
- dependency-track:6.0.1
- display-url-api:2.209.v582ed814ff2f
- docker-commons:457.v0f62a\_94f11a\_3
- docker-workflow:621.va\_73f881d9232
- dtkit-api:3.0.3
- durable-task:587.v84b\_877235b\_45
- echarts-api:5.6.0-4
- eddsa-api:0.3.0.1-19.vc432d923e5ee
- emoji-symbols-api:16.0-26.v9818ff7423f0
- extended-read-permission:61.vf24570ff3b\_e9
- favorite:2.237.v79163ca\_8b\_892
- flatpickr-api:4.6.13-18.vcf5f6a\_5b\_8468
- font-awesome-api:6.7.2-1
- forensics-api:3.1.0
- git:5.7.0
- git-changelog:3.45
- git-client:6.1.3
- github:1.43.0
- github-api:1.321-488.v9b\_c0da\_9533f8
- github-branch-source:1822.v9eec8e5e69e3
- google-compute-engine:4.683.v0ce26579a\_ee7
- google-login:109.v022b\_cf87b\_e5b\_
- google-metadata-plugin:0.6.70.v87a\_e90994a\_32
- google-oauth-plugin:1.335.ve6de40e2db\_18
- google-source-plugin:0.4
- gradle:2.15
- groovy-postbuild:272.v52a\_03efb\_8653
- gson-api:2.13.1-139.v4569c2ef303f
- handy-uri-templates-2-api:2.1.8-36.v85e4cb\_234a\_13
- htmlpublisher:425
- influxdb:5.0
- instance-identity:203.v15e81a\_1b\_7a\_38
- ionicons-api:88.va\_4187cb\_eddf1
- jackson2-api:2.18.3-402.v74c4eb\_f122b\_2
- jakarta-activation-api:2.1.3-2
- jakarta-mail-api:2.1.3-2
- javadoc:327.vdfe586651ee0
- javax-activation-api:1.2.0-8
- javax-mail-api:1.6.2-11
- jaxb:2.3.9-133.vb\_ec76a\_73f706
- jdk-tool:83.v417146707a\_3d
- jenkins-design-language:1.27.20
- jersey2-api:2.45-154.v4ded3dc34f81
- jfrog:1.5.8
- jira:3.17
- jjwt-api:0.11.5-120.v0268cf544b\_89
- job-dsl:1.93
- joda-time-api:2.14.0-127.v7d9da\_295a\_d51
- jquery3-api:3.7.1-3
- jsch:0.2.16-95.v3eecb\_55fa\_b\_78
- json-api:20250517-153.vc8a\_a\_d87c0ce3
- json-path-api:2.9.0-148.v22a\_7ffe323ce
- jsoup:1.20.1-46.ve5f1416988c2
- junit:1335.v6b\_a\_a\_e18534e1
- kafkalogs:0.1.8
- kerberos-sso:247.v5b\_3c2105a\_9e3
- kubernetes:4353.vb\_47977da\_9417
- kubernetes-client-api:6.10.0-251.v556f5f100500
- kubernetes-credentials:192.v4d5b\_1c429d17
- lockable-resources:1349.v8b\_ccb\_c5487f7
- mailer:489.vd4b\_25144138f
- matrix-auth:3.2.6
- matrix-project:849.v0cd64ed7e531
- maven-plugin:3.26
- mercurial:1309.v6802b\_f0efb\_b\_9
- metrics:4.2.32-476.v5042e1c1edd7
- mina-sshd-api-common:2.15.0-161.vb\_200831a\_c15b\_
- mina-sshd-api-core:2.15.0-161.vb\_200831a\_c15b\_
- multibranch-action-triggers:1.8.10
- oauth-credentials:0.657.v7d8dd90b\_0382
- okhttp-api:4.11.0-189.v976fa\_d3379d6
- oss-symbols-api:324.v432cce4172ca\_
- parameter-separator:276.v7b\_5328f5c7a\_d
- people-view:1.2
- pipeline-build-step:567.vea\_ce550ece97
- pipeline-graph-analysis:241.vc3d48fb\_b\_2582
- pipeline-groovy-lib:752.vdddedf804e72
- pipeline-input-step:527.vd61b\_1d3c5078
- pipeline-milestone-step:138.v78ca\_76831a\_43
- pipeline-model-api:2.2255.v56a\_15e805f12
- pipeline-model-definition:2.2255.v56a\_15e805f12
- pipeline-model-extensions:2.2255.v56a\_15e805f12
- pipeline-multibranch-defaults:2.1
- pipeline-rest-api:2.38
- pipeline-stage-step:322.vecffa\_99f371c
- pipeline-stage-tags-metadata:2.2255.v56a\_15e805f12
- pipeline-stage-view:2.38
- pipeline-utility-steps:2.19.0
- plain-credentials:195.vb\_906e9073dee
- plugin-util-api:6.1.0
- prism-api:1.30.0-1
- prometheus:819.v50953a\_c560dd
- pubsub-light:1.19
- robot:6.0.0
- role-strategy:777.v4fe2599cb\_f48
- run-condition:243.v3c3f94e46a\_8b\_
- schedule-build:667.vda\_a\_fe31e1659
- scm-api:704.v3ce5c542825a\_
- script-security:1373.vb\_b\_4a\_a\_c26fa\_00
- simple-theme-plugin:211.v5424a\_5510e47
- snakeyaml-api:2.3-125.v4d77857a\_b\_402
- sonar:2.18
- sse-gateway:1.28
- ssh-agent:386.v36cc0c7582f0
- ssh-credentials:355.v9b\_e5b\_cde5003
- ssh-slaves:3.1031.v72c6b\_883b\_869
- sshd:3.353.v2b\_d33c46e970
- stash-pullrequest-builder:1.17
- structs:350.v3b\_30f09f2363
- support-core:1725.va\_2a\_9f06eed61
- tap:2.4.4
- token-macro:444.v52de7e9c573d
- trilead-api:2.209.v0e69b\_c43c245
- variant:70.va\_d9f17f859e0
- warnings-ng:12.6.0
- workflow-aggregator:608.v67378e9d3db\_1
- workflow-api:1373.v7b\_813f10efa\_b\_
- workflow-basic-steps:1079.vce64b\_a\_929c5a\_
- workflow-cps:4106.v7a\_8a\_8176d450
- workflow-durable-task-step:1405.v1fcd4a\_d00096
- workflow-job:1532.va\_9a\_d244074a\_3
- workflow-multibranch:806.vb\_b\_688f609ee9
- workflow-scm-step:437.v05a\_f66b\_e5ef8
- workflow-step-api:700.v6e45cb\_a\_5a\_a\_21
- workflow-support:968.v8f17397e87b\_8
- xunit:3.1.5

---

<div class="post-metadata">

**Author:** ![mawinter69](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/mawinter69/32/1625_2.png) [@mawinter69](https://community.jenkins.io/u/mawinter69)\
**Post date:** [July 2, 2025, 6:05pm UTC](https://community.jenkins.io/t/jenkins-credential-add-create-obfuscate-in-logs-and-clean-remove-within-build-pipeline-run/33443/2 "2025-07-02T18:05:50Z")

</div>

Technically possible. You would need to write a pipeline library that is then added as a globally trusted library. That is not straightforward, you need to look at the code of the [credentials](https://github.com/jenkinsci/credentials-plugin) plugin how to add a new credential programmatically.  
Ideally you write a step that allows to execute a block ([Extending with Shared Libraries](https://www.jenkins.io/doc/book/pipeline/shared-libraries/#defining-custom-steps)) so that you have automatic cleanup. In the end you would call it like this, where you defined a new step with name `withTemporaryToken`. The step will set an env variable with name `TEMPORARY_CREDENTIALSID`. Assumption is that you create a credential of type `Secret text`

```auto
def token = createNewToken(...) // this will create the new token value
withTemporaryToken(token) {
  withCredentials([string(credentialsId: TEMPORARY_CREDENTIALSID, variable: 'SECRET')]) {
    // do something with the secret
  }
  // or call another step that has a credentialsID as parameter
}

```

The new step would need to call that block in a try finally block where in the finally you remove the credential from the store. Something like this in a file `vars/withTemporaryToken.groovy`

```auto
def call(storeLocation, tokenValue, Closure body)
  def credentialId = createCredentials(storeLocation, tokenValue)
  try {
    withEnv(['TEMPORARY_CREDENTIALSID=' + credentialId]) {
      body()
    }
  } finally {
    removeCredential(storeLocation, credentialId)
  }
}

```