# Create an application credential

> Create an Identity application credential so that scripts, CI jobs and tools can get tokens for one project without your password.

An application credential is an ID and secret that can get tokens for one project. Use one
wherever your password would otherwise be stored, such as in a script, a CI pipeline, or a
monitoring tool. You can limit its roles, give it an expiry date, and delete it at any time
without changing your password.

## Before you begin

You need the `openstack` CLI [signed in](/developer/cli) to the project the credential is for. A
credential always acts on the project it was created in.

## 1. Create the credential

```sh
openstack application credential create billing-reports \
  --description "Monthly cost export" \
  --expiration 2027-01-01T00:00:00 \
  -c id -c name -c expires_at -c secret
```

```
+------------+----------------------------------------------------------------------------------------+
| Field      | Value                                                                                  |
+------------+----------------------------------------------------------------------------------------+
| expires_at | 2027-01-01T00:00:00.000000                                                             |
| id         | 3c2b8e1f4a6d4c0e9b7a5f3d1e2c4b6a                                                       |
| name       | billing-reports                                                                        |
| secret     | Jq7mX2vL9pR4tW8yZ1bC5nF3hK6dS0gAuE2iO7qT4wY9rU1oP3aL6sD8fG5hJ2kZ0xC7vB4nM1qW8eR3tY6u |
+------------+----------------------------------------------------------------------------------------+
```

Identity shows the `secret` only once. Store it in your secret manager now.

These options narrow what the credential can do:

| Option                | Effect                                                                                          |
| --------------------- | ----------------------------------------------------------------------------------------------- |
| `--expiration <time>` | The credential stops working at this time.                                                      |
| `--role <role>`       | Give it only this role in the project. Repeat for more roles. Without it, it gets all of yours. |
| `--unrestricted`      | Allow it to create and delete other credentials. Leave this off unless a tool needs it.         |

## 2. Use the credential

Tools that read `clouds.yaml`, including the `openstack` CLI and the OpenStack SDK, take the
credential like this:

```yaml title="~/.config/openstack/clouds.yaml"
clouds:
  billing:
    auth_type: v3applicationcredential
    auth:
      auth_url: https://auth.vexxhost.net/v3
      application_credential_id: 3c2b8e1f4a6d4c0e9b7a5f3d1e2c4b6a
      application_credential_secret: Jq7mX2vL9pR4tW8yZ1bC5nF3hK6dS0gAuE2iO7qT4wY9rU1oP3aL6sD8fG5hJ2kZ0xC7vB4nM1qW8eR3tY6u
```

Tools that read environment variables take the same values as `OS_AUTH_TYPE`, `OS_AUTH_URL`,
`OS_APPLICATION_CREDENTIAL_ID` and `OS_APPLICATION_CREDENTIAL_SECRET`. The credential carries its
project, so it needs no project or domain settings.

## Verify

```sh
openstack --os-cloud billing token issue -c project_id
```

The output shows the project the credential was created in.

## Rotate or delete a credential

To rotate a credential, create a new one, switch your tool to it, then delete the old one:

```sh
openstack application credential delete billing-reports
```

Deleting a credential stops it from getting new tokens immediately. Tokens it already issued work
until they expire.

## Next steps

* [Get a token](/identity/get-a-token) from the credential for direct API calls.
* [Use OpenStack from Python](/developer/python) with the credential.