# AWX Custom creds used in template are displayed in plain text as part of Output **URL:** \ **Category:** Get Help\ **Tags:** awx\ **Created:** [August 7, 2024, 2:56pm UTC](https://forum.ansible.com/t/awx-custom-creds-used-in-template-are-displayed-in-plain-text-as-part-of-output/7716 "2024-08-07T14:56:12Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![prateektl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/prateektl/32/8985_2.png) [@prateektl](https://forum.ansible.com/u/prateektl)\ **Post date:** [August 7, 2024, 2:56pm UTC](https://forum.ansible.com/t/awx-custom-creds-used-in-template-are-displayed-in-plain-text-as-part-of-output/7716/1 "2024-08-07T14:56:12Z")
We have created a custom credentials and using it as part of the job template. But the issue is, the credentials passed as part of these custom creds is being displayed in plain text in the output of the job. What modification or changes needs to be done, so that credentials that are used as part of the custom creds are not displayed. We are already using no\_log: true in the task where the custom cred are used. But this is not a solution as it can be tweaked by different members and read the credentials. Also it will be hard to troubleshoot the issue when the task is enabled with no\_log. In other platform, as soon as the credential type is used, it will be hidden with asterisk (\*\*\*), is there something similar in AWX? **Custom Credential Type:** ![image](https://us1.discourse-cdn.com/ansible/original/2X/e/e36062b71e8ddc3cdec65b65ebb7c19fed14acdc.png) ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [August 7, 2024, 4:23pm UTC](https://forum.ansible.com/t/awx-custom-creds-used-in-template-are-displayed-in-plain-text-as-part-of-output/7716/2 "2024-08-07T16:23:43Z")
It sounds like the problem is that you’re seeing your secret in stdout. Ansible has no way of knowing what part of stdout may or may not contain sensitive or secret information. That’s why `no_log` exists in the first place, to hide programmatically-indiscernible secret information. There _are_ modules that are intelligent enough to hide secrets in their output, but things like `command` `shell` and `uri` are not among them. If you could show us samples of your playbooks/roles, how you’re using your awx\_token, and explain a bit more of what you’re trying to do (in case it isn’t obvious in your samples); we may be able to help a little more. On another note, you appear to be creating a custom credential for an AWX credential? Is there a reason you can’t use the existing `Red Hat Ansible Automation Platform` credential? ---
**Author:** ![prateektl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/prateektl/32/8985_2.png) [@prateektl](https://forum.ansible.com/u/prateektl)\ **Post date:** [August 9, 2024, 7:46am UTC](https://forum.ansible.com/t/awx-custom-creds-used-in-template-are-displayed-in-plain-text-as-part-of-output/7716/3 "2024-08-09T07:46:34Z")
Thanks for responding to this topic @Denney-tech , Let me give you an example on how we are using this custom credentials. Also as noted by you, we often use URI and Command Shell modules in our playbooks. ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [August 9, 2024, 6:38pm UTC](https://forum.ansible.com/t/awx-custom-creds-used-in-template-are-displayed-in-plain-text-as-part-of-output/7716/4 "2024-08-09T18:38:28Z")
One solution could be to set the `awx_token` as an environment variable. If you add it as an environment variable in the custom credential, that will be exposed at Ansible’s _control\_node_ level, meaning you could set `CONTROLLER_OAUTH_TOKEN` and use your token with the `awx.awx` collection. However, you’ll need to set the environment variable at the play/task level the same way you would for regular vars to help hide it in shell tasks. E.g. Setting environment var in task from custom credential’s extra\_vars/env\_vars. ```yaml # Injector configuration for your custom credential in awx extra_vars: awx_token: '{{ awx_token }}' env: AWX_TOKEN: '{{ awx_token }}' CONTROLLER_OAUTH_TOKEN: '{{ awx_token }}' ``` ```yaml # Shell task in some play - name: My custom shell with env var ansible.builtin.shell: cmd: | echo "${AWX_TOKEN}" > /dev/null # this is fine echo "{{ awx_token }}" > /dev/null # this is bad echo "${AWX_TOKEN}" # this is worse echo "{{ awx_token }}" # this is the worst environment: AWX_TOKEN: "{{ awx_token | default(lookup('env', 'AWX_TOKEN') | default('')) }}" ``` In the above task, redirecting the output to `/dev/null` prevents exposing the token to stdout. `${AWX_TOKEN}` is the env variable, and is not exposed on the cli or in the `cmd` key of the module’s output. This makes the first echo safe since you will not see the token in the module’s output (i.e. `{'results': {'cmd': 'echo "${AWX_TOKEN}"', 'stdout': ''}}`). On the other hand, you will see the `{{ awx_token }}` in plaintext in the `cmd` key, and definitely see either var in the stdout if it is not redirected or otherwise used in a parameter. * * * With the `ansible.builtin.uri`, I’m not sure that there’s any way to hide the token, but you might be able to use `{{ lookup('env', 'AWX_TOKEN') }}` in the argument to set the header. I’m not sure if the module output would show the literal jinja string or the resulting lookup value. Like so: ```yaml - ansible.builtin.uri: uri: "https://awx.domain.local/api/v2/inventories" return_content: true headers: Authorization: "Bearer {{ lookup('env', 'AWX_TOKEN') }}" ``` In this case, the only time I could see the token in testing is if verbosity was increased. It is not in the module output. Haven’t tested it in AWX, so I’m not sure what the module parameters might look like in the job details/output (with or without verbosity increased).