GoogleContainerTools/jib · error · RegistryCredentialsNotSentException

Credentials were not sent to ${serverUrl}/${imageName}

Error message

Credentials were not sent to ${serverUrl}/${imageName}

What it means

In the same HTTP-401 handling branch of RegistryEndpointCaller.call, if the server responds 401 and the response indicates the request's Authorization header was not forwarded/accepted (requestAuthorizationCleared()), Jib throws RegistryCredentialsNotSentException ('Credentials were not sent to <serverUrl>/<imageName>').

Source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryEndpointCaller.java:160

    } catch (ResponseException ex) {
      // First, see if the endpoint provider handles an exception as an expected response.
      try {
        return registryEndpointProvider.handleHttpResponseException(ex);

      } catch (ResponseException responseException) {
        if (responseException.getStatusCode() == HttpStatusCodes.STATUS_CODE_BAD_REQUEST
            || responseException.getStatusCode() == HttpStatusCodes.STATUS_CODE_NOT_FOUND
            || responseException.getStatusCode()
                == HttpStatusCodes.STATUS_CODE_METHOD_NOT_ALLOWED) {
          // The name or reference was invalid.
          throw newRegistryErrorException(responseException);

        } else if (responseException.getStatusCode() == HttpStatusCodes.STATUS_CODE_FORBIDDEN) {
          throw new RegistryUnauthorizedException(serverUrl, imageName, responseException);

        } else if (responseException.getStatusCode() == HttpStatusCodes.STATUS_CODE_UNAUTHORIZED) {
          if (responseException.requestAuthorizationCleared()) {
            throw new RegistryCredentialsNotSentException(serverUrl, imageName);
          } else {
            // Credentials are either missing or wrong.
            throw new RegistryUnauthorizedException(serverUrl, imageName, responseException);
          }

        } else {
          // Unknown
          throw responseException;
        }
      }

    } catch (IOException ex) {
      logError("I/O error for image [" + serverUrl + "/" + imageName + "]:");
      logError("    " + ex.getClass().getName());
      logError("    " + (ex.getMessage() == null ? "(null exception message)" : ex.getMessage()));
      logErrorIfBrokenPipe(ex);

      if (ex instanceof SSLException) {

View on GitHub (pinned to fb949e2676)

Solutions

1. Provide credentials for the registry (docker login or Jib authUsername/authPassword or credential helper)
2. Set up the credential helper binary for the registry (gcr, ecr, acr) and ensure it is on PATH in CI
3. If the image is public, check the exact repository path/namespace is correct — a typo makes a public image look private

Example fix

// before: fresh CI container with no docker config
jib:build  // anonymous request -> 401
// after: mount or create credentials first
echo "$REGISTRY_PASSWORD" | docker login registry.example.com -u _json_key --password-stdin
mvn jib:build

// fail fast if no credentials are configured for the registry
if (dockerConfigLacksEntry(registry) && credentialHelperMissing(registry)) { throw new IllegalStateException("Run docker login " + registry + " first"); }

try { ...registry ops...; } catch (RegistryCredentialsNotSentException e) { throw new BuildException("Credentials were not sent to " + registry + "/" + repo + " — configure docker login or a credential helper", e); }

When it happens

Trigger: A registry endpoint call receives 401 with requestAuthorizationCleared() true — typically the auth flow sent no Authorization header (anonymous request) and the registry requires credentials.

Common situations: No credentials resolved for the registry (no docker config, no credential helper); credential helper returns empty credentials; intentionally anonymous pull of a private image; environments where ~/.docker/config.json is absent (fresh CI container).

Related errors

• Credentials were not sent to ${registryUrl}/${imageName}
• ${helpfulSuggestions.forNoCredentialsDefined(registryUnautho
• Did not get token in authentication response from ${authenti
• Failed to authenticate with registry ${registryUrl}/${imageN
• Unauthorized for ${serverUrl}/${imageName}

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/1e6427faa63cc7d4. Report an issue: GitHub.