---
name: codeengine-ts-sb-cosredacted
title: Why do the service credentials in my service binding to IBM Cloud Object Storage show as `REDACTED`?
description: When you create a Code Engine service binding with an IBM Cloud Object Storage service instance, the service credentials show as `REDACTED`.
last-updated: 2023-02-02
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/codeengine?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Why do the service credentials in my service binding to IBM Cloud Object Storage show as `REDACTED`?
{: #ts-sb-cosredacted}
{: troubleshoot}

When you create a Code Engine service binding with an IBM Cloud Object Storage service instance, the service credentials show as `REDACTED`.

After you create a service binding to an Object Storage instance and you use your own service credential, the service credentials for the binding to your Code Engine app or job shows as `REDACTED` in the environment variables, instead of showing the service credential values.
{: tsSymptoms}

To retrieve existing service credentials, Object Storage requires that the user (or service ID) that retrieves the service credential must have the additional IAM action of `resource-controller.credential.retrieve_all`. This IAM action is included in the `COS Reader` or the Platform `Administrator` access role.
{: tsCauses}

Try one of these solutions.
{: tsResolve}

1. Do not use custom service credentials when you create service bindings to Object Storage with Code Engine. Instead, use the default service binding access policies and let Code Engine generate the credentials for you. See [Using the default service binding access policies](https://cloud.ibm.com/docs/codeengine?topic=codeengine-configure-bindaccess&format=markdown#bind-auto-servid).

2. If you want to use a custom service ID with Code Engine service bindings, you must also add the `COS Reader` service access when you assign access for the service ID. See [Using a custom service ID for service bindings](https://cloud.ibm.com/docs/codeengine?topic=codeengine-configure-bindaccess&format=markdown#bind-custom-servid).