Create an application credential
Create an Identity application credential so that scripts, CI jobs and tools can get tokens for one project without your password.
An application credential is an ID and secret that can get tokens for one project. Use one wherever your password would otherwise be stored, such as in a script, a CI pipeline, or a monitoring tool. You can limit its roles, give it an expiry date, and delete it at any time without changing your password.
Before you begin
You need the openstack CLI signed in to the project the credential is for. A
credential always acts on the project it was created in.
1. Create the credential
openstack application credential create billing-reports \
--description "Monthly cost export" \
--expiration 2027-01-01T00:00:00 \
-c id -c name -c expires_at -c secret+------------+----------------------------------------------------------------------------------------+
| Field | Value |
+------------+----------------------------------------------------------------------------------------+
| expires_at | 2027-01-01T00:00:00.000000 |
| id | 3c2b8e1f4a6d4c0e9b7a5f3d1e2c4b6a |
| name | billing-reports |
| secret | Jq7mX2vL9pR4tW8yZ1bC5nF3hK6dS0gAuE2iO7qT4wY9rU1oP3aL6sD8fG5hJ2kZ0xC7vB4nM1qW8eR3tY6u |
+------------+----------------------------------------------------------------------------------------+Identity shows the secret only once. Store it in your secret manager now.
These options narrow what the credential can do:
| Option | Effect |
|---|---|
--expiration <time> | The credential stops working at this time. |
--role <role> | Give it only this role in the project. Repeat for more roles. Without it, it gets all of yours. |
--unrestricted | Allow it to create and delete other credentials. Leave this off unless a tool needs it. |
2. Use the credential
Tools that read clouds.yaml, including the openstack CLI and the OpenStack SDK, take the
credential like this:
clouds:
billing:
auth_type: v3applicationcredential
auth:
auth_url: https://auth.vexxhost.net/v3
application_credential_id: 3c2b8e1f4a6d4c0e9b7a5f3d1e2c4b6a
application_credential_secret: Jq7mX2vL9pR4tW8yZ1bC5nF3hK6dS0gAuE2iO7qT4wY9rU1oP3aL6sD8fG5hJ2kZ0xC7vB4nM1qW8eR3tY6uTools that read environment variables take the same values as OS_AUTH_TYPE, OS_AUTH_URL,
OS_APPLICATION_CREDENTIAL_ID and OS_APPLICATION_CREDENTIAL_SECRET. The credential carries its
project, so it needs no project or domain settings.
Verify
openstack --os-cloud billing token issue -c project_idThe output shows the project the credential was created in.
Rotate or delete a credential
To rotate a credential, create a new one, switch your tool to it, then delete the old one:
openstack application credential delete billing-reportsDeleting a credential stops it from getting new tokens immediately. Tokens it already issued work until they expire.
Next steps
- Get a token from the credential for direct API calls.
- Use OpenStack from Python with the credential.