Ansible Tower playbook credential question

[Qingyu Hu]

Hey gang

New kid on the block here. Not sure if this is the right forum to ask questions regarding ansible towers, I know I can contact support and I have emailed them but I was hoping there are wiser gurus out here that can help answer my question.

So the question is this: I am demoing tower for my company and tower has it's encrypted credential in the database which I really like the idea of. I am building a simple provision VM play book but vmware_guest requires the username and password entry. So how do I reference/use my stored credential in ansible tower database? I have selected the correct credential in the template for the job but the error is saying I must have user name and password defined in the playbook. Is there a variable in the playbook where I can reference tower's password? 

only thing I found online is to encrypt the password in vault and program the vault password and use that in the template. That's just lame because now I got 2 place to manage password and vault is less secure because there is only 1 password and no RBAC.

thanks in advance!

chang