Introduction

Welcome to this Akeyless tutorial video. In this video, we will demonstrate how integrating Akeyless with TeamCity secures delivery workflows by replacing standing credentials with automated, temporary access on demand.

Eliminating long-lived static credentials in favor of short-lived, automated access-on-demand reduces the risk of secret leaks while streamlining access control without adding friction for developers.

The Artifactory Target

Here's our Artifactory instance, where we store the artifacts our applications depend on. Pipelines need credentials to access these repositories. Traditionally, that means storing a token in the CI/CD platform and keeping it updated. Let's replace that long-lived token with temporary access issued when the build needs it.

In Akeyless, we start with a connection to Artifactory, called a Target. This centralizes the credentials used to create those temporary tokens. Here you can see our current target. Developers and pipelines don't need access to that privileged credential. They simply request the access they're authorized to use. That gives the security team centralized control without adding work for developers.

Dynamic Credentials

Next, we create a dynamic credential producer and define what that access looks like: what the pipeline can do and how long its token remains valid. For example, one pipeline might only need to read artifacts, while another needs to publish to a specific repository. Each gets the permissions it needs, for a limited period.

When we request a credential as you see here, Akeyless generates a fresh Artifactory token. Once it expires, it can no longer be used. This reduces the exposure from forgotten credentials and removes the need to regularly replace static tokens across individual pipelines.

TeamCity Integration & Authentication

Now let's bring that into TeamCity. We want the build to obtain access automatically, without someone copying and pasting a token so we create a JWT token authentication method for that. We also need to establish which build is asking for access.

In this setup, TeamCity provides a signed JWT token for the build. Akeyless verifies that identity and applies our access policies. We can restrict access based on the build's claims, so an approved project receives the appropriate permissions. There's no additional long-lived Akeyless password or API key to maintain in TeamCity.

The Akeyless plugin makes this straightforward for the pipeline owner. We go into TeamCity and configure how it authenticates, then reference the Akeyless secret path in a build parameter. The build script uses that parameter as it normally would. Developers don't need to implement the credential request themselves or manage token renewals.

Running the Build

Let's run the build. The plugin authenticates the build, requests its temporary Artifactory credential, and makes it available to the job. It also registers the resolved secret for masking in the build logs.

This results in our pipeline successfully listing the Artifactory repositories using the token it just received. The job gets the access it needs, and that access ends when the token expires. We've kept the developer workflow simple while giving security control over who gets access, what they can do, and for how long.

Conclusion

What we've demonstrated is a move from stored credentials to access on demand. Fewer long-lived secrets to maintain, less exposure if a token is compromised, and less manual work for engineering teams. The same approach can extend to supported databases, cloud services, and other systems—bringing consistent access controls to more of your delivery workflow.