Skip to content
Latchkey

Jenkins withCredentials "Could not find credentials" - Fix Bindings

A withCredentials block referenced a credential ID Jenkins cannot resolve, or bound it with the wrong binding type. The credential is missing, lives in a folder/scope the job cannot see, or its kind does not match the binding you used.

What this error means

A pipeline fails with Could not find credentials entry with ID '<id>', or a binding error like "credentials are not <type>". The step never ran the protected command because the binding could not be set up.

Jenkins console
ERROR: Could not find credentials entry with ID 'aws-deploy-key'
# or a type mismatch:
ERROR: credentials with ID 'docker-login' are not a UsernamePassword

Common causes

Credential ID missing or out of scope

The ID does not exist, was renamed, or is stored at a scope (a different folder, or System scope) the job’s context cannot access.

Wrong binding type for the credential kind

Using usernamePassword(...) for a Secret Text credential (or string(...) for a username/password) raises a type-mismatch binding error.

How to fix it

Match the binding to the credential kind

Use the binding that corresponds to how the credential is stored.

Jenkinsfile
withCredentials([
  usernamePassword(credentialsId: 'docker-login',
                   usernameVariable: 'USER', passwordVariable: 'PASS'),
  string(credentialsId: 'npm-token', variable: 'NPM_TOKEN')
]) {
  sh 'echo "$PASS" | docker login -u "$USER" --password-stdin'
}

Put the credential in a reachable scope

  1. Confirm the exact ID under Manage Jenkins → Credentials (or the folder’s credentials).
  2. Store it at the folder/Global scope the job can read - not System scope, which pipelines cannot use.
  3. Generate the binding snippet with the Snippet Generator to get the right binding type.

How to prevent it

  • Keep credential IDs stable and reference them consistently across Jenkinsfiles.
  • Scope credentials to the folder that needs them (least privilege, reachable).
  • Use the Snippet Generator so the binding type always matches the credential kind.

Related guides

Tired of flaky CI? Latchkey auto-heals failed jobs and retries them for you. Start free →