Application credentials

Create project-scoped credentials for Terraform, CLI tools, CI, and other automation.

Application credentials let automation authenticate to OpenStack without using your interactive login password. They are commonly used by Terraform, CI jobs, OpenStack CLI automation, and scripts that need project-scoped API access.

Use them for automation. Do not use them for interactive browser login.

🔐 The secret is shown once

Save the generated secret immediately in your approved secret store. If it is lost, create a new application credential.

Project-scoped

Create the credential in the Skyline project that the automation should manage.

Automation use

Use it for Terraform, CI, OpenStack CLI tools, and scripts.

Minimum role

Choose the least privilege role when role selection is available.

No version control

Keep clouds.yaml, secrets, state, and generated credentials out of Git.

Before you create one

Confirm:

You are in the correct Skyline project.
You know which automation will use the credential.
You can store the generated secret outside version control.
You understand that the secret is shown once.

If role selection is exposed, choose the minimum role required for the automation.

Create an application credential

Switch to the correct project in Skyline.
Click your user icon in the top-right corner of the dashboard.
In the dropdown, click User Center.
In the User Center left sidebar, open Application Credentials.
Create a new credential with a clear name, such as the project and automation purpose.
Set an expiration date if your workflow allows it.
Save the generated secret immediately.

Store secrets safely

Treat the generated secret like a password. Do not commit or share:

clouds.yaml.
Terraform variable files containing secrets.
CI logs that print provider configuration.
Chat messages or tickets containing credential secrets.

If the secret is lost, create a new application credential. If it may have been exposed, delete it and rotate automation to a new one.

Use with Terraform

Terraform usually reads OpenStack connection details from a project-local clouds.yaml or environment variables. The mustelinet Keystone/OpenStack authentication URL is:

https://keystone.openstack.mustelinet.com

Keep connection files local to the project workspace and exclude them from version control.

See Terraform for the broader automation model.