Scripts that call Jenkins should use API tokens, not passwords. A token request skips the CSRF crumb step, can be loaded from a file instead of typed on a command line, and can be replaced without changing the account password people use to log in.
Passwords versus tokens
| Point | Password | API token |
|---|---|---|
| CSRF | Client must fetch a crumb from /crumbIssuer/api, keep the session cookie, and send everything on each call | Requests are exempt from CSRF checks |
| CLI | Works with -auth but discouraged | Recommended, loaded from a file |
| Exposure | The same secret opens the UI | Separate from the login password |
| Rotation | Changes the user's login | Replace the token only |
These points come from the Jenkins CSRF and CLI documentation. The CLI page says tokens taken from the user's configure page and loaded from a file with @ are the recommended way. Setting JENKINS_USER_ID and JENKINS_API_TOKEN together is another route, and -auth overrides them.
Safe habits
- Dedicated users. Create one automation user per integration, with the smallest permission set that works. Check it with the
who-am-iCLI command. - Store tokens as secrets. In other systems, use their secret store. In Jenkins, use credentials rather than writing tokens into a Jenkinsfile.
- Keep tokens out of command lines and logs. Loading from a file keeps them out of process listings and shell history.
- Rotate on a schedule and on departure. Tokens belong to a user. When people leave, check what they created.
- Review. Look at users with tokens and ask whether each is still needed.
What a token does not fix
A token carries the permissions of its user. If the user is an admin, a leaked token is an admin token. Scope the user, not just the credential. Also, an old plugin or core version can have its own flaws, so keep both current.
Scripts that need the older path
If you must use a username and password, follow the documented flow: request a crumb, store the session cookie from the response, then send username, password, crumb and cookie on every request. Many legacy scripts skip the crumb and break after protection is turned on, which is one reason teams disable CSRF. Switching them to tokens is the cleaner repair.
Try it yourself
The demo walks through an API security scan, which checks how endpoints handle authentication.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard scans dependencies and applies policies and gates to pipelines. Run the free scan on a repository to see sample output.
Quick check
Do API token calls need a crumb?
No. Requests using a username and API token are exempt from CSRF checks.
Where do I get a token?
From the user's configure page in Jenkins, which the CLI documentation points to.
Sources
Last reviewed: 19 October 2026.
