Allows various kinds of credentials (secrets) to be used in idiosyncratic ways. Each binding will define an environment variable active within the scope of the step. You can then use them directly from any other steps that expect environment variables to be set:


node {
  withCredentials([[$class: 'UsernamePasswordMultiBinding', credentialsId: 'mylogin',
                    usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD']]) {
    sh '''
      set +x
      curl -u $USERNAME:$PASSWORD https://private.server/ > output
    '''
  }
}

or retrieve values from Groovy code via the env magic variable:

def password = env.PASSWORD

Note that some steps explicitly ask for credentials of a particular kind, usually as a credentialsId parameter, in which case this step is unnecessary.

For bindings which store a secret file, beware that


node {
  dir('subdir') {
    withCredentials([[$class: 'FileBinding', credentialsId: 'secret', variable: 'FILE']]) {
      sh 'use $FILE'
    }
  }
}

is not safe, as $FILE might be inside the workspace (in subdir@tmp/secretFiles/), and thus visible to anyone able to browse the job’s workspace. If you need to run steps in a different directory than the usual workspace, you should instead use


node {
  withCredentials([[$class: 'FileBinding', credentialsId: 'secret', variable: 'FILE']]) {
    dir('subdir') {
      sh 'use $FILE'
    }
  }
}

to ensure that the secrets are outside the workspace; or choose a different workspace entirely:

node { ws { withCredentials([[$class: 'FileBinding', credentialsId: 'secret', variable: 'FILE']]) { sh 'use $FILE' } } }