GoogleContainerTools/jib · error · RegistryAuthenticationFailedException

Did not get token in authentication response from ${authenti

Error message

Did not get token in authentication response from ${authenticationUrl}; parameters: ${authRequestParameters}

What it means

RegistryAuthenticator.authenticate performs the OAuth2/token exchange against the registry's auth server and expects a JSON body containing a token field. If the response parses but has no token, RegistryAuthenticationFailedException is thrown with the authentication URL and request parameters, since the flow cannot continue without a bearer token.

Source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java:289

              .setUserAgent(userAgent);

      if (isOAuth2Auth(credential)) {
        String parameters = getAuthRequestParameters(credential, repositoryScopes);
        requestBuilder.setBody(
            new BlobHttpContent(Blobs.from(parameters), MediaType.FORM_DATA.toString()));
      } else if (credential != null) {
        requestBuilder.setAuthorization(
            Authorization.fromBasicCredentials(credential.getUsername(), credential.getPassword()));
      }

      String httpMethod = isOAuth2Auth(credential) ? HttpMethods.POST : HttpMethods.GET;
      try (Response response = httpClient.call(httpMethod, url, requestBuilder.build())) {

        AuthenticationResponseTemplate responseJson =
            JsonTemplateMapper.readJson(response.getBody(), AuthenticationResponseTemplate.class);

        if (responseJson.getToken() == null) {
          throw new RegistryAuthenticationFailedException(
              registryUrl,
              imageName,
              "Did not get token in authentication response from "
                  + getAuthenticationUrl(credential, repositoryScopes)
                  + "; parameters: "
                  + getAuthRequestParameters(credential, repositoryScopes));
        }
        return Authorization.fromBearerToken(responseJson.getToken());
      }

    } catch (ResponseException ex) {
      if (ex.getStatusCode() == HttpStatusCodes.STATUS_CODE_UNAUTHORIZED
          && ex.requestAuthorizationCleared()) {
        throw new RegistryCredentialsNotSentException(registryUrl, imageName);
      }
      throw new RegistryAuthenticationFailedException(registryUrl, imageName, ex);

    } catch (IOException ex) {

View on GitHub (pinned to fb949e2676)

Solutions

Verify the registry's auth URL actually returns {"token": "..."} for the given credentials
Fix credentials (username/password) — some auth servers return empty bodies on bad credentials
Check custom authUrlTokenPattern/registry auth configuration in the build tool matches your registry (e.g., for Artifactory, Harbor)
Capture the raw auth-server response (curl the authUrl with the same parameters) to see what it actually returns

Example fix

// before: wrong custom auth URL config
RegistryAuthenticator.fromAuthenticationMethod("Bearer realm=\"https://old-auth.example.com/token\"", ...);
// after: point at the correct realm advertised by the registry
RegistryAuthenticator.fromAuthenticationMethod("Bearer realm=\"https://auth.example.com/service/token\",service=\"registry.docker.io\"", ...);

Defensive patterns

Strategy: validation

Validate before calling

// sanity check the auth realm returns a token schema
curl -s "https://auth.example.com/service/token?service=registry&scope=repository:my/repo:pull" -u user:pass | jq '.token'

Try / catch

try { authenticator.authenticate(pullScope); } catch (RegistryAuthenticationFailedException e) { throw new BuildException("Auth server did not return a token; check auth config", e); }

Prevention

Verify registry auth realm configuration against your registry vendor's docs
Test the token endpoint manually with curl before wiring it into builds
Keep registry/auth server versions current

When it happens

Trigger: The auth server (e.g., the /service/token endpoint) returns 200 with a JSON body lacking a 'token' (or the expected fields) after calling authenticate with the credential and repository scopes.

Common situations: Pointing Jib at a custom auth endpoint that returns a different JSON schema (e.g., 'access_token' only with no token mapping, or an HTML error page that accidentally parses); misconfigured registry-wide auth (registry.auth) settings in build config; private registry gateways returning soft-200 responses.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/3b28027511c471a7. Report an issue: GitHub.