GoogleContainerTools/jib · error · RegistryAuthenticationFailedException

'Bearer' was not found in the 'WWW-Authenticate' header, tri

Error message

'Bearer' was not found in the 'WWW-Authenticate' header, tried to parse: ${authenticationMethod}

What it means

Jib parses the WWW-Authenticate header of a registry's 401 response to obtain a bearer token. It only supports 'Bearer' authentication; if the header's scheme is not 'Bearer ' (case-insensitive), the authentication handshake fails with this error naming the unsupported method.

Source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java:85

   *     href="https://docs.docker.com/registry/spec/auth/token/#how-to-authenticate">https://docs.docker.com/registry/spec/auth/token/#how-to-authenticate</a>
   */
  static Optional<RegistryAuthenticator> fromAuthenticationMethod(
      String authenticationMethod,
      RegistryEndpointRequestProperties registryEndpointRequestProperties,
      @Nullable String userAgent,
      FailoverHttpClient httpClient)
      throws RegistryAuthenticationFailedException {
    // If the authentication method starts with 'basic' (case insensitive), no registry
    // authentication is needed.
    if (authenticationMethod.matches("^(?i)(basic).*")) {
      return Optional.empty();
    }

    String registryUrl = registryEndpointRequestProperties.getServerUrl();
    String imageName = registryEndpointRequestProperties.getImageName();
    // Checks that the authentication method starts with 'bearer ' (case insensitive).
    if (!authenticationMethod.matches("^(?i)(bearer) .*")) {
      throw newRegistryAuthenticationFailedException(
          registryUrl, imageName, authenticationMethod, "Bearer");
    }

    Pattern realmPattern = Pattern.compile("realm=\"(.*?)\"");
    Matcher realmMatcher = realmPattern.matcher(authenticationMethod);
    if (!realmMatcher.find()) {
      throw newRegistryAuthenticationFailedException(
          registryUrl, imageName, authenticationMethod, "realm");
    }
    String realm = realmMatcher.group(1);

    Pattern servicePattern = Pattern.compile("service=\"(.*?)\"");
    Matcher serviceMatcher = servicePattern.matcher(authenticationMethod);
    // use the provided registry location when missing service (e.g., for OpenShift)
    String service = serviceMatcher.find() ? serviceMatcher.group(1) : registryUrl;

    return Optional.of(
        new RegistryAuthenticator(

View on GitHub (pinned to fb949e2676)

Solutions

Configure the registry to use token (Bearer) authentication with a proper auth service, or use a standard registry implementation
Ensure correct credentials are supplied via docker login / Jib auth configuration so the registry issues Bearer challenges
Use an HTTPS, spec-compliant registry or mirror (e.g. registry:2 with token auth)
Check that a proxy in front of the registry is not stripping or replacing the WWW-Authenticate header

Example fix

// registry auth before: auth enforced by reverse proxy (Basic only)
// after: run registry v2 with token service
REGISTRY_AUTH=token \
REGISTRY_AUTH_TOKEN_REALM=https://auth.example.com/token \
REGISTRY_AUTH_TOKEN_SERVICE=registry.example.com \
registry:2

Defensive patterns

Strategy: validation

Validate before calling

// inspect the challenge before building
HttpURLConnection c = (HttpURLConnection) new URL("https://registry/v2/").openConnection();
String wwwAuth = c.getHeaderField("WWW-Authenticate");
if (wwwAuth == null || !wwwAuth.matches("(?i)bearer .*")) {
  throw new IllegalStateException("Registry does not offer Bearer auth: " + wwwAuth);
}

Try / catch

try {
  jibBuild.containerize(...);
} catch (RegistryAuthenticationException e) {
  // fall back to explicit credentials or a compliant registry
  configureCredentialsManually(e);
}

Prevention

Prefer registries with standard token-based (Bearer) auth
docker login first so credential helpers supply working credentials
Check WWW-Authenticate headers with curl when adding a new registry

When it happens

Trigger: A registry returns a WWW-Authenticate header whose scheme is Basic, Digest, Negotiate, or otherwise not 'Bearer ...' when Jib requests the image.

Common situations: Pulling from registries that only support HTTP Basic auth without a token service; misconfigured authentication proxies; corporate registry mirrors with non-standard auth.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/c98d75debc47aa9b. Report an issue: GitHub.