IBM Cloud Docs
Why am I getting Authorization required errors in Container Registry?

Why am I getting Authorization required errors in Container Registry?

You are trying to access IBM Cloud® Container Registry but are getting Authorization required errors.

When you try to access Container Registry, you get one of the following messages.

The following alternatives are possible causes:

Scenario A. You're trying to push or a pull an image, but you don't have a valid credential.

  • You attempted to log in to Container Registry with an invalid API key.
  • You attempted to access Container Registry without logging in.
  • A client attempted to access Container Registry without a bearer token.
  • A client attempted to access Container Registry with an expired OAuth token.

For more information about how to fix this problem, see Scenario A. You're trying to push or pull an image.

Scenario B. You're logged in to the wrong region of Container Registry. To check which region you're logged in to, run the ibmcloud cr region command.

For more information about how to fix this problem, see Scenario B. You're logged in to the wrong region.

Scenario C. You're trying to use the API.

  • You attempted to authenticate against the Container Registry API with an invalid API key.
  • You attempted to authenticate against the Container Registry API with an invalid Account ID.

For more information about how to fix this problem, see Scenario C. You're trying to use the API.

You can fix this problem in the following ways:

Scenario A. You're trying to push or pull an image

You can't access Container Registry because you don't have a valid credential.

You can fix these problems in the following ways:

  • Check the information about logging a client into Container Registry, see Push images to your namespace.
  • Create and use a valid IAM API key to log a client, such as Docker, in to Container Registry with username iamapikey and the API key as your password. For more information, see Managing user API keys.
  • When you access Container Registry by using automation, set up a service ID and API key. For more information, see Accessing Container Registry.

Scenario B. You're logged in to the wrong region

You can't access Container Registry because you're logged in to the wrong region.

To check which region you're logged in to, run the ibmcloud cr region command.

You can fix this problem in the following way:

If your image is in a different region of Container Registry, you must log in to IBM Cloud in the correct region by running the following commands.

  1. ibmcloud cr region-set <region>, where <region> is the name of the region, see Local regions.
  2. ibmcloud cr login

For more information, see Targeting a local region.

Scenario C. You're trying to use the API

You can't access Container Registry because you attempted to authenticate against the Container Registry API with an invalid API key or Account ID.

You can fix this problem in the following ways:

  • Use the ibmcloud CLI or IAM API to retrieve a valid OAuth token to authenticate against the Container Registry API. For more information, see IBM Cloud Container Registry API - Authentication.
  • When you authenticate against the Container Registry API, ensure that you use a valid Account ID. You can retrieve your Account ID by running the ibmcloud account show command.