Jenkins Secret text credential. Paste the Bearer Token from Rancher (Avatar → Account API Keys): the token-…:… string only, not Access Key alone and not the word Bearer.

Leave Scope empty (No Scope) unless the key is only for one cluster. A cluster-scoped key cannot call global /v3 APIs; this plugin checks /v3/clusters/{id}.