<p>Specifically for credentials, CloudBees recommends using the Credentials Plugins, which inject the credentials in the environment available to the invoked scripts. From <a href="https://support.cloudbees.com/hc/en-us/articles/203802500-Injecting-Secrets-into-Jenkins-Build-Jobs" rel="noreferrer">Injecting Secrets into Jenkins Build Jobs</a>:</p>

<blockquote>
  <ul>
  <li><a href="https://wiki.jenkins-ci.org/display/JENKINS/Credentials+Plugin" rel="noreferrer">Credentials plugin</a> - provides a centralized way to define credentials that can be used by your Jenkins instance, plugins and
  build jobs.</li>
  <li><a href="https://wiki.jenkins-ci.org/display/JENKINS/Credentials+Binding+Plugin" rel="noreferrer">Credentials Binding plugin</a> - allows you to configure your build jobs to inject credentials as environment variables.</li>
  <li><a href="https://wiki.jenkins-ci.org/display/JENKINS/Plain+Credentials+Plugin" rel="noreferrer">Plain Credentials plugin</a> - a plugin dependency required by the Credentials Binding plugin.</li>
  </ul>
</blockquote>

<p>Inside your script you'd pick up the variable from the script's environment:</p>

<pre><code>API_TOKEN = os.getenv('API_TOKEN')
</code></pre>

<p>In a similar way you can pass any arbitrary variables (other than credentials), using the <a href="https://wiki.jenkins.io/display/JENKINS/EnvInject+Plugin" rel="noreferrer">EnvInject Plugin</a> (watch for the warnings, tho). See related:</p>

<ul>
<li><a href="https://stackoverflow.com/questions/31203816/jenkins-inject-environment-variable">Jenkins inject environment variable</a></li>
<li><a href="https://stackoverflow.com/questions/21130931/environment-variables-in-jenkins">Environment variables in Jenkins</a></li>
</ul>

<p>Another possible approach is to configure Jenkins to pass the value as an argument to your script. Inside your script you'd pick up the value using your preferred method of processing the script arguments.</p>

CC BY-SA 4.0
2018-06-27T13:46:47.543Z
2018-06-27T13:46:47.543Z
Dan Cornilescu
<p>If you are using Pipeline (i.e. Jenkinsfile), use <a href="https://jenkins.io/doc/pipeline/steps/credentials-binding/" rel="nofollow noreferrer"><code>withCredentials</code></a>.  To give a quick and dirty example:</p>

<pre><code>withCredentials([[
  $class: 'UsernamePasswordMultiBinding',
  credentialsId: 'my-credentials',
  usernameVariable: 'user',
  passwordVariable: 'pw',
]]) {
  sh("./my-python-script.py --user ${user} --password ${pw}")
}
</code></pre>

<p>Your credentials will be automatically redacted from the console output to help prevent sensitive information from leaking.</p>

CC BY-SA 4.0
2019-07-25T18:28:35.457Z
One thing to beware: credentials plugin hide secrets from jenkins console only.  Should the python script create a log and store the secret there, it will not be masked.   At present, I know of no way to clean a log file effectively.  Waiting on https://issues.jenkins-ci.org/browse/JENKINS-58664
Peter Kahn
CC BY-SA 4.0
2018-06-27T16:08:35.993Z
2018-10-03T15:32:40.703Z
2018-10-03T15:32:40.703Z
jayhendren
<p>I have a global jenkins credential and a config script that includes the line</p>

<pre><code>API_TOKEN = "Token XXX"
</code></pre>

<p>For security reasons we can't keep the token in the script itself as its in version control. Is there a way to pass the jenkins credential to the python config script from jenkins?</p>

CC BY-SA 4.0
2018-06-27T13:26:12.137Z
How is Jenkins configured to invoke your script?
Dan Cornilescu
<jenkins><python>
Passing a jenkins credential (global) to a python script
CEamonn
# Passing a jenkins credential (global) to a python script

(Asked by: username_0 on 2018-06-27)

I have a global jenkins credential and a config script that includes the line
API_TOKEN = "Token XXX"

For security reasons we can't keep the token in the script itself as its in version control. Is there a way to pass the jenkins credential to the python config script from jenkins?

**Tags:** jenkins, python

> **Comments:**
> **username_1**: How is Jenkins configured to invoke your script?  

---

## 2 answers

### Answer by username_1 on 2018-06-27. Score: 6

Specifically for credentials, CloudBees recommends using the Credentials Plugins, which inject the credentials in the environment available to the invoked scripts. From Injecting Secrets into Jenkins Build Jobs:


Credentials plugin - provides a centralized way to define credentials that can be used by your Jenkins instance, plugins and
  build jobs.
Credentials Binding plugin - allows you to configure your build jobs to inject credentials as environment variables.
Plain Credentials plugin - a plugin dependency required by the Credentials Binding plugin.


Inside your script you'd pick up the variable from the script's environment:
API_TOKEN = os.getenv('API_TOKEN')

In a similar way you can pass any arbitrary variables (other than credentials), using the EnvInject Plugin (watch for the warnings, tho). See related:

Jenkins inject environment variable
Environment variables in Jenkins

Another possible approach is to configure Jenkins to pass the value as an argument to your script. Inside your script you'd pick up the value using your preferred method of processing the script arguments.


---

### Answer by username_2 on 2018-06-27. Score: 4

If you are using Pipeline (i.e. Jenkinsfile), use withCredentials.  To give a quick and dirty example:
withCredentials([[
  $class: 'UsernamePasswordMultiBinding',
  credentialsId: 'my-credentials',
  usernameVariable: 'user',
  passwordVariable: 'pw',
]]) {
  sh("./my-python-script.py --user ${user} --password ${pw}")
}

Your credentials will be automatically redacted from the console output to help prevent sensitive information from leaking.

> **Comments:**
> **username_3**: One thing to beware: credentials plugin hide secrets from jenkins console only.  Should the python script create a log and store the secret there, it will not be masked.   At present, I know of no way to clean a log file effectively.  Waiting on https://issues.jenkins-ci.org/browse/JENKINS-58664  

---

