GoogleContainerTools/jib · error · RegistryCredentialsNotSentException

Credentials were not sent to ${registryUrl}/${imageName}

Error message

Credentials were not sent to ${registryUrl}/${imageName}

What it means

During token authentication, if the auth server responds HTTP 401 and the response indicates that request authorization was cleared (credentials were not forwarded), Jib throws RegistryCredentialsNotSentException. This means the credentials Jib had were never transmitted/accepted by the auth endpoint, typically because none were provided or the server stripped them.

Source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java:303

        AuthenticationResponseTemplate responseJson =
            JsonTemplateMapper.readJson(response.getBody(), AuthenticationResponseTemplate.class);

        if (responseJson.getToken() == null) {
          throw new RegistryAuthenticationFailedException(
              registryUrl,
              imageName,
              "Did not get token in authentication response from "
                  + getAuthenticationUrl(credential, repositoryScopes)
                  + "; parameters: "
                  + getAuthRequestParameters(credential, repositoryScopes));
        }
        return Authorization.fromBearerToken(responseJson.getToken());
      }

    } catch (ResponseException ex) {
      if (ex.getStatusCode() == HttpStatusCodes.STATUS_CODE_UNAUTHORIZED
          && ex.requestAuthorizationCleared()) {
        throw new RegistryCredentialsNotSentException(registryUrl, imageName);
      }
      throw new RegistryAuthenticationFailedException(registryUrl, imageName, ex);

    } catch (IOException ex) {
      throw new RegistryAuthenticationFailedException(registryUrl, imageName, ex);
    }
  }
}

View on GitHub (pinned to fb949e2676)

Solutions

  1. Configure credentials: run 'docker login' for the registry or set up a credential helper (gcr, ecr, acr) so Jib can find them
  2. Check ~/.docker/config.json contains an auths entry or credHelpers entry for the target registry
  3. If the registry truly allows anonymous pull, ensure the image/repository is public
  4. Verify the auth server realm accepts Basic auth rather than rejecting all forwarded credentials

Example fix

// before: no credentials configured
docker login myregistry.example.com  // run this outside the build
// after: credentials available so token request includes Authorization header
echo "$PASSWORD" | docker login myregistry.example.com -u user --password-stdin
Defensive patterns

Strategy: validation

Validate before calling

// ensure credentials exist before building
if (!Files.readAllLines(Path.of(System.getProperty("user.home"), ".docker", "config.json")).stream().anyMatch(l -> l.contains("registry.example.com"))) { throw new IllegalStateException("Run docker login first"); }

Try / catch

try { client.pullBlob(...); } catch (RegistryCredentialsNotSentException e) { throw new BuildException("No credentials for " + registry + " — run docker login", e); }

Prevention

When it happens

Trigger: authenticate() catches a ResponseException with status 401 whose requestAuthorizationCleared() is true while authenticating against registryUrl/imageName.

Common situations: Anonymous build against a private registry where no credential helpers/docker config supply credentials; docker credential helper broken or not configured so Jib sends no Authorization header; misconfigured credential store making Jib fall back to anonymous auth.

Related errors

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/3146363976ac2466. Report an issue: GitHub.