A Secret text credential holding a Namespace API token.

Mint one scoped to just what this plugin needs:

nsc token create \
  --name jenkins \
  --expires_in 720h \
  --grant '{"resource_type":"instance","resource_id":"*",
            "actions":["create","destroy","get","list","wait"]}' \
  --grant '{"resource_type":"instance/o11y/logs","resource_id":"*",
            "actions":["get"]}'

resource_id is not optional. Omit it and the token can still create and list instances — those are not checked against a particular resource — but get, wait and destroy match nothing. The result is a token that creates instances it cannot wait for or tear down, leaking them until their deadline expires.

Use Test connection to verify each action individually.