WithCredentials block usage in Jenkins - Step-by-Step Execution

Process Flow - WithCredentials block usage

Start Pipeline

↓

Enter withCredentials block

↓

Credentials injected as env vars

↓

Use credentials inside block

↓

Exit withCredentials block

↓

Credentials removed from env

↓

Continue pipeline

The pipeline starts, enters the withCredentials block where credentials are injected as environment variables, uses them securely inside the block, then removes them after exiting the block.

Execution Sample

Jenkins

withCredentials([usernamePassword(credentialsId: 'myCreds', usernameVariable: 'USER', passwordVariable: 'PASS')]) {
  sh 'echo Using $USER and $PASS'
}
sh 'echo Credentials no longer available'

This Jenkins pipeline snippet uses withCredentials to inject username and password as environment variables only inside the block.

Process Table

Step	Action	Environment Variables	Command Run	Output
1	Enter withCredentials block	USER=myUser, PASS=myPass	sh 'echo Using $USER and $PASS'	Using myUser and myPass
2	Exit withCredentials block	USER and PASS removed	sh 'echo Credentials no longer available'	Credentials no longer available

💡 Credentials environment variables removed after withCredentials block ends to keep them secure

Status Tracker

Variable	Start	Inside withCredentials	After withCredentials
USER	undefined	myUser	undefined
PASS	undefined	myPass	undefined

Key Moments - 2 Insights

Why can't I access USER and PASS variables outside the withCredentials block?

Because the execution_table shows that USER and PASS are only set inside the withCredentials block and removed immediately after it ends to keep credentials secure.

What happens if I try to print the password outside the block?

The variable PASS is undefined outside the block, so the output will not show the password, as confirmed in the execution_table step 2.

Visual Quiz - 3 Questions

Look at the execution table, what is the value of USER inside the withCredentials block?

A myPass

B myUser

C undefined

D CredentialsId

💡 Hint

Check the Environment Variables column at Step 1 in the execution_table

At which step are the credentials removed from environment variables?

A Step 2

B Step 1

C Before Step 1

D Credentials never removed

💡 Hint

Look at the Environment Variables column at Step 2 in the execution_table

If you try to use $PASS outside the withCredentials block, what happens?

A It prints the password

B It prints the username

C It prints nothing or error

D It prints the credentialsId

💡 Hint

Refer to variable_tracker showing PASS is undefined after withCredentials block

Concept Snapshot

withCredentials block securely injects credentials as environment variables
Credentials are only available inside the block
After block ends, credentials are removed from environment
Use credentials inside the block for secure access
Outside the block, variables are undefined
Prevents accidental credential leaks

Full Transcript

The withCredentials block in Jenkins pipelines is used to securely inject credentials as environment variables only inside the block. When the pipeline enters the block, the specified credentials are set as environment variables like USER and PASS. Commands inside the block can use these variables safely. Once the block finishes, the credentials are removed from the environment to prevent leaks. This means outside the block, the variables are undefined and cannot be accessed. This flow ensures credentials are only exposed for the minimum time needed during pipeline execution.

Practice

1. What is the main purpose of the withCredentials block in a Jenkins pipeline?

easy

A. To display credentials in the console output for debugging

B. To permanently store credentials in the pipeline script

C. To securely inject credentials only inside the block without exposing them elsewhere

D. To create new credentials in Jenkins

Solution

1. Step 1: Understand the purpose of withCredentials

   The block is designed to provide credentials securely only within its scope.

2. Step 2: Analyze other options

   Options A, B, and D describe incorrect or unsafe behaviors not related to withCredentials.

3. Final Answer:

   To securely inject credentials only inside the block without exposing them elsewhere -> Option C

4. Quick Check:

   Secure injection inside block = C [OK]

Hint: Remember: credentials only live inside the block [OK]

Common Mistakes:

• Thinking credentials persist outside the block
• Assuming credentials are printed in logs
• Confusing with credential creation

2. Which of the following is the correct syntax to use a username and password credential with withCredentials in a Jenkins pipeline?

easy

A. withCredentials([usernamePassword(credentialsId: 'cred-id', usernameVariable: 'USER', passwordVariable: 'PASS')]) { ... }

B. withCredentials(usernamePassword('cred-id', 'USER', 'PASS')) { ... }

C. withCredentials { usernamePassword('cred-id', 'USER', 'PASS') ... }

D. withCredentials([usernamePassword('cred-id', 'USER', 'PASS')]) { ... }

Solution

1. Step 1: Recall correct withCredentials syntax

   The correct syntax uses a list with usernamePassword specifying named parameters.

2. Step 2: Check each option

   Only withCredentials([usernamePassword(credentialsId: 'cred-id', usernameVariable: 'USER', passwordVariable: 'PASS')]) { ... } uses named parameters and list syntax correctly; others miss brackets or parameter names.

3. Final Answer:

   withCredentials([usernamePassword(credentialsId: 'cred-id', usernameVariable: 'USER', passwordVariable: 'PASS')]) { ... } -> Option A

4. Quick Check:

   Named params + list = A [OK]

Hint: Use named parameters inside a list for credentials [OK]

Common Mistakes:

• Omitting square brackets around credentials
• Not using named parameters
• Wrong block structure

3. Given this Jenkins pipeline snippet:

withCredentials([string(credentialsId: 'token-id', variable: 'TOKEN')]) {
  sh 'echo $TOKEN'
}

What will happen when this pipeline runs?

medium

A. The token will be printed as plain text in the Jenkins UI

B. The secret token value will be printed in the console output

C. The pipeline will fail because $TOKEN is not accessible

D. The shell command will print the token value but it will be masked in logs

Solution

1. Step 1: Understand withCredentials behavior

   The secret is injected as an environment variable inside the block and Jenkins masks it in logs.

2. Step 2: Analyze the shell command output

   The echo $TOKEN prints the token, but Jenkins hides it in console output to protect secrets.

3. Final Answer:

   The shell command will print the token value but it will be masked in logs -> Option D

4. Quick Check:

   Secrets masked in logs = A [OK]

Hint: Secrets print masked, not visible in logs [OK]

Common Mistakes:

• Assuming secrets print as plain text
• Thinking environment variables are unavailable
• Confusing console output with UI display

4. Identify the error in this Jenkins pipeline snippet:

withCredentials([usernamePassword(credentialsId: 'cred-id', usernameVariable: 'USER')]) {
  sh 'echo $USER $PASS'
}

medium

A. Missing passwordVariable parameter causes $PASS to be undefined

B. Credentials ID is incorrect format

C. The sh step cannot access environment variables

D. The withCredentials block must not use a list

Solution

1. Step 1: Check withCredentials parameters

   The snippet provides only usernameVariable but misses passwordVariable.

2. Step 2: Understand impact on shell command

   Since passwordVariable is missing, $PASS is undefined and will cause an empty or error output.

3. Final Answer:

   Missing passwordVariable parameter causes $PASS to be undefined -> Option A

4. Quick Check:

   Both username and password variables needed = D [OK]

Hint: Always specify both usernameVariable and passwordVariable [OK]

Common Mistakes:

• Forgetting passwordVariable
• Assuming shell can't access env vars
• Wrong credentialsId format

5. You want to use multiple credentials (a username/password and a secret text) inside a Jenkins pipeline securely. Which is the correct way to use withCredentials to access both?

hard

A. withCredentials(usernamePassword(credentialsId: 'cred1', usernameVariable: 'USER', passwordVariable: 'PASS')) {
withCredentials(string(credentialsId: 'cred2', variable: 'TOKEN')) { ... }
}

B. withCredentials([usernamePassword(credentialsId: 'cred1', usernameVariable: 'USER', passwordVariable: 'PASS'), string(credentialsId: 'cred2', variable: 'TOKEN')]) { ... }

C. withCredentials([usernamePassword('cred1', 'USER', 'PASS'), string('cred2', 'TOKEN')]) { ... }

D. withCredentials([usernamePassword(credentialsId: 'cred1', usernameVariable: 'USER', passwordVariable: 'PASS')]) { withCredentials([string(credentialsId: 'cred2', variable: 'TOKEN')]) { ... } }

Solution

1. Step 1: Understand multiple credentials usage

   You can pass multiple credentials as a list inside a single withCredentials block.

2. Step 2: Compare options

   withCredentials([usernamePassword(credentialsId: 'cred1', usernameVariable: 'USER', passwordVariable: 'PASS'), string(credentialsId: 'cred2', variable: 'TOKEN')]) { ... } correctly uses a list with both credential types together. Options A and D nest blocks unnecessarily. withCredentials([usernamePassword('cred1', 'USER', 'PASS'), string('cred2', 'TOKEN')]) { ... } uses wrong syntax.

3. Final Answer:

   withCredentials([usernamePassword(credentialsId: 'cred1', usernameVariable: 'USER', passwordVariable: 'PASS'), string(credentialsId: 'cred2', variable: 'TOKEN')]) { ... } -> Option B

4. Quick Check:

   Multiple creds in one list = B [OK]

Hint: Use one list with all credentials inside withCredentials [OK]

Common Mistakes:

• Nesting multiple withCredentials blocks unnecessarily
• Using incorrect parameter syntax
• Passing credentials without a list