curl --request POST \
--url https://registry.{region}.basaltic.sh/v1/authorization-token \
--header 'Authorization: Bearer <token>'import requests
url = "https://registry.{region}.basaltic.sh/v1/authorization-token"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://registry.{region}.basaltic.sh/v1/authorization-token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://registry.{region}.basaltic.sh/v1/authorization-token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://registry.{region}.basaltic.sh/v1/authorization-token"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://registry.{region}.basaltic.sh/v1/authorization-token")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://registry.{region}.basaltic.sh/v1/authorization-token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"authorization_data": {
"authorization_token": "<string>",
"username": "basaltic",
"password": "<string>",
"endpoint": "cr.sa-saopaulo-1.basaltic.cloud",
"expires_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}Get a docker login credential
Mints the short-lived password docker login consumes.
A POST rather than a GET because the response is a bearer secret: a GET would land in browser history, proxy access logs, and any intermediary that records URLs.
The credential identifies the principal and nothing more. It names
no repository and grants no access — the docker daemon exchanges it
at /v2/token for per-repository bearer tokens, and every
authorization decision is made there, against the policies as they
stand at that moment.
Requires registry:GetAuthorizationToken. That is a separate
permission from any repository action: a principal may be allowed
to pull through this API without being allowed to hand a docker
daemon a credential.
curl --request POST \
--url https://registry.{region}.basaltic.sh/v1/authorization-token \
--header 'Authorization: Bearer <token>'import requests
url = "https://registry.{region}.basaltic.sh/v1/authorization-token"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://registry.{region}.basaltic.sh/v1/authorization-token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://registry.{region}.basaltic.sh/v1/authorization-token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://registry.{region}.basaltic.sh/v1/authorization-token"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://registry.{region}.basaltic.sh/v1/authorization-token")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://registry.{region}.basaltic.sh/v1/authorization-token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"authorization_data": {
"authorization_token": "<string>",
"username": "basaltic",
"password": "<string>",
"endpoint": "cr.sa-saopaulo-1.basaltic.cloud",
"expires_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}registry:GetAuthorizationToken. See REGISTRY permissions for the full list, what each one covers, and an example policy.Authorizations
An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>.
This is the recommended way to authenticate.
Get one by exchanging a service account's access key pair at
POST /v1/oauth/token with grant_type=client_credentials. It is the
standard client-credentials grant, so any OAuth-aware library will
obtain and refresh it for you.
curl -s -u "$KEY_ID:$SECRET" -d grant_type=client_credentials \
https://iam.basaltic.sh/v1/oauth/token
Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.
Response
A docker credential valid for 12 hours.
Show child attributes
Show child attributes

