How to create application credentials

Create application credentials to authenticate against the OpenStack API without using your account password. Application credentials are the recommended authentication method for CI/CD pipelines, automation scripts, Terraform, and the OpenStack CLI.

Each credential is scoped to a single project and can be restricted to specific roles. Unlike API tokens, application credentials do not expire after 24 hours; you control the lifetime.

Create an application credential#

ConsoleCLI

1. Select API > App Credentials in the sidebar.
2. Select Create Application Credential.
3. Fill in the credential fields:

Field	Required	Description
Name	Yes	A descriptive name (e.g., ci-deploy, terraform-prod)
Expires At	No	Date and time when the credential becomes invalid. Leave empty for no expiration.
Roles	No	Restrict the credential to specific roles. Leave empty to inherit your current roles. See Available roles.
Unrestricted	No	When checked, allows the credential to create other credentials, manage trusts, and manage Kubernetes clusters. Leave unchecked unless you need it.
Description	No	Purpose or owner of this credential

1. Select OK to generate the credential.
2. The console displays the credential ID and secret, labeled Credential Id and Credential Secret in the dialog. Both values are shown only once. Copy each with the copy icon beside it, or download a credential file (next step), and store them securely.
3. Optionally select openrc.sh or clouds.yaml to download a credential file, or use the copy icon beside each to copy its contents. Both files configure the CLI; clouds.yaml is preferred when you work with more than one OpenStack deployment.
4. Select Close.

Click to zoom

To delete a credential, select it in the list, select Delete, then select Confirm in the Delete Application Credential dialog.

Available roles#

The roles in the Roles field depend on your project. The create dialog lists the roles you can assign to a credential. Commonly available roles include:

Leave Roles empty to inherit the roles from your current token. Pass a role name to the CLI with --role, for example --role member.

Configure clouds.yaml#

After creating an application credential, configure your OpenStack CLI and SDKs by placing a clouds.yaml file at ~/.config/openstack/clouds.yaml:

clouds:
  quakeai:
    auth:
      auth_url: https://keystone.rumble.cloud/v3
      application_credential_id: YOUR_CREDENTIAL_ID
      application_credential_secret: YOUR_CREDENTIAL_SECRET
    auth_type: v3applicationcredential
    region_name: us-east-1  # us-east-1 | us-east-2 | us-west-1
    interface: public
    identity_api_version: 3

Then select the cloud in your shell:

export OS_CLOUD=quakeai
openstack server list

The CLI discovers service endpoints from the Keystone catalog automatically; you do not need to configure individual service URLs.

Use the openrc.sh file#

If you downloaded the openrc.sh file from the console, source it to set environment variables:

source openrc-MY_CREDENTIAL.sh
openstack server list

The openrc.sh approach is equivalent to clouds.yaml; it uses shell environment variables instead of a configuration file. Choose whichever fits your workflow. clouds.yaml supports multiple clouds and is preferred for projects that interact with more than one OpenStack deployment.

Security considerations#

• Prefer restricted credentials. Leave the Unrestricted checkbox unchecked unless you specifically need to manage trusts, create other credentials, or provision Kubernetes clusters. Restricted credentials limit blast radius.
• Set expiration dates for credentials used in temporary environments (staging, testing, demos).
• Rotate credentials periodically. Delete old credentials and create new ones; there is no "rotate" action. Create a replacement before deleting the old one.
• One credential per service. Use separate credentials for CI/CD, Terraform, monitoring, and interactive use. This makes revocation granular.

See also#

• API access console reference: overview of the API section in the console
• App credentials reference: console reference for the credentials view
• Service Endpoints: all 12 service base URLs with clouds.yaml example
• How to get an API token: quick ad-hoc tokens for testing
• S3 credentials: separate credentials for S3-compatible object storage access
• Install OpenStack client: CLI installation