Why am I getting Authorization required
errors in Container Registry?
You are trying to access IBM Cloud® Container Registry but are getting Authorization required
errors.
When you try to access Container Registry, you get one of the following messages.
Authorization required. See https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-auth-req
You were not authorized to complete this operation.
CRG0014E An error occurred when authenticating your request with IBM Cloud. Clear your browser cookies, log in to IBM Cloud, and try your request again.
Status code 401 Unauthorized
, you might see this message if you are using IBM Cloud Code Engine, see Why am I getting anUnauthorized
error when I'm using Code Engine? for assistance.UNAUTHORIZED: Authorization required
, you might see this message if you are usingcosign
with Podman, see Why am I having problems when I try to pull an image withcosign
when I'm using Podman? for assistance.
The following alternatives are possible causes:
Scenario A. You're trying to push or a pull an image, but you don't have a valid credential.
- You attempted to log in to Container Registry with an invalid API key.
- You attempted to access Container Registry without logging in.
- A client attempted to access Container Registry without a bearer token.
- A client attempted to access Container Registry with an expired OAuth token.
For more information about how to fix this problem, see Scenario A. You're trying to push or pull an image.
Scenario B. You're logged in to the wrong region of Container Registry. To check which region you're logged in to, run the ibmcloud cr region
command.
For more information about how to fix this problem, see Scenario B. You're logged in to the wrong region.
Scenario C. You're trying to use the API.
- You attempted to authenticate against the Container Registry API with an invalid API key.
- You attempted to authenticate against the Container Registry API with an invalid Account ID.
For more information about how to fix this problem, see Scenario C. You're trying to use the API.
You can fix this problem in the following ways:
Scenario A. You're trying to push or pull an image
You can't access Container Registry because you don't have a valid credential.
You can fix these problems in the following ways:
- Check the information about logging a client into Container Registry, see Push images to your namespace.
- Create and use a valid IAM API key to log a client, such as Docker, in to Container Registry with username
iamapikey
and the API key as your password. For more information, see Managing user API keys. - When you access Container Registry by using automation, set up a service ID and API key. For more information, see Accessing Container Registry.
Scenario B. You're logged in to the wrong region
You can't access Container Registry because you're logged in to the wrong region.
To check which region you're logged in to, run the ibmcloud cr region
command.
You can fix this problem in the following way:
If your image is in a different region of Container Registry, you must log in to IBM Cloud in the correct region by running the following commands.
ibmcloud cr region-set <region>
, where<region>
is the name of the region, see Local regions.ibmcloud cr login
For more information, see Targeting a local region.
Scenario C. You're trying to use the API
You can't access Container Registry because you attempted to authenticate against the Container Registry API with an invalid API key or Account ID.
You can fix this problem in the following ways:
- Use the
ibmcloud
CLI or IAM API to retrieve a valid OAuth token to authenticate against the Container Registry API. For more information, see IBM Cloud Container Registry API - Authentication. - When you authenticate against the Container Registry API, ensure that you use a valid Account ID. You can retrieve your Account ID by running the
ibmcloud account show
command.