Application Credentials

Overview

Application credentials allow automation pipelines, CI/CD systems, and service accounts to authenticate without embedding user passwords. They are scoped to the user’s current project and role assignments, and can be restricted further to a specific subset of roles or API paths. Unlike user passwords, application credentials have explicit expiry dates and can be revoked independently.

Prerequisites

An active Polystack account with appropriate permissions
Access to the Polystack Dashboard or CLI configured with credentials
API credentials sourced (source openrc.sh)

Application credentials are bound to the creating user. If that user is disabled or deleted, all their application credentials are invalidated immediately. For long-lived service accounts, create a dedicated service user to own the credentials.

Create an Application Credential

Dashboard
CLI

Navigate to Application Credentials

Log in as the user who will own the credential. Navigate to User Center > Application Credentials (via profile dropdown) and click Create Application Credential.

Configure the credential

Field	Description
Name	Descriptive identifier (e.g., `ci-pipeline-prod`)
Secret	Leave blank to auto-generate a cryptographically secure secret
Expiration Date	Set an expiry for credentials used in short-lived pipelines
Roles	Restrict to a subset of your role assignments (optional)
Access Rules	Limit the credential to specific API paths and HTTP methods

Save the credential securely

After creation, the Dashboard displays the credential ID and secret once. Download the clouds.yaml snippet for immediate use.

The secret is shown only once and cannot be retrieved again. Store it in a secrets manager (such as Polystack Key Management or HashiCorp Vault) immediately after creation.

Authenticate

Source your credentials file to authenticate with the Polystack platform:

Load credentials

source openrc.sh

Your administrator provides the RC (credentials) file for your project. See CLI Setup for configuration details.

Create the credential

Create application credential with expiry

openstack application credential create \
  --description "CI/CD pipeline credential" \
  --expiration "2026-12-31T00:00:00" \
  ci-pipeline-prod

Note the id and secret values from the output — they are shown only once.

Create credential with restricted roles

Create credential restricted to reader role only

openstack application credential create \
  --description "Read-only monitoring credential" \
  --role reader \
  --expiration "2026-12-31T00:00:00" \
  monitoring-readonly

Authenticate with Application Credentials

Application credentials replace user passwords in the clouds.yaml configuration file.

Add to clouds.yaml

Add the following to your ~/.config/openstack/clouds.yaml:

~/.config/openstack/clouds.yaml

clouds:
  polystack-ci:
    auth:
      auth_url: https://api.<your-domain>:5000/v3
      application_credential_id: "<CREDENTIAL_ID>"
      application_credential_secret: "<CREDENTIAL_SECRET>"
    auth_type: v3applicationcredential
    region_name: RegionOne

Test the credential

Verify authentication with the credential

openstack --os-cloud polystack-ci token issue

A token is issued — the credential is valid and functional.

Access Rules

Access rules restrict a credential to specific API operations, providing fine-grained control beyond role-level permissions.

Create credential with access rules

openstack application credential create \
  --description "Image upload only" \
  --access-rules '[
    {"path": "/v2/images", "method": "POST", "service": "image"},
    {"path": "/v2/images/**", "method": "PUT", "service": "image"}
  ]' \
  image-uploader

Field	Description
`path`	API path pattern (supports `**` wildcard)
`method`	HTTP method: `GET`, `POST`, `PUT`, `DELETE`, `PATCH`
`service`	Service type: `compute`, `image`, `identity`, `volume`, `network`

Manage Existing Credentials

Dashboard
CLI

Navigate to User Center > Application Credentials (via profile dropdown) to view all credentials owned by the current user. Delete expired or unused credentials to reduce attack surface.

openstack application credential list

openstack application credential show ci-pipeline-prod

openstack application credential delete ci-pipeline-prod

Rotate application credentials before their expiration date. Create the replacement credential first, update all consumers, then delete the old credential. This zero-downtime rotation pattern avoids pipeline interruptions.

Next Steps

Users

Manage user accounts that own application credentials.

Multi-Factor Authentication

Add TOTP-based two-factor authentication to user accounts.

Identity Admin Guide

Configure token policies and security hardening for your Identity deployment.

Troubleshooting

Resolve credential rejection and authentication failure issues.

Core Services

Other Services

Overview

Create an Application Credential

Navigate to Application Credentials

Configure the credential

Save the credential securely

Authenticate

Create the credential

Create credential with restricted roles

Authenticate with Application Credentials

Add to clouds.yaml

Test the credential

Access Rules

Manage Existing Credentials

Next Steps

Users

Multi-Factor Authentication

Identity Admin Guide

Troubleshooting

​Overview

​Create an Application Credential

Navigate to Application Credentials

Configure the credential

Save the credential securely

Authenticate

Create the credential

Create credential with restricted roles

​Authenticate with Application Credentials

Add to clouds.yaml

Test the credential

​Access Rules

​Manage Existing Credentials

​Next Steps

Users

Multi-Factor Authentication

Identity Admin Guide

Troubleshooting

Overview

Create an Application Credential

Authenticate with Application Credentials

Access Rules

Manage Existing Credentials

Next Steps