{"record":{"id":"1e6427faa63cc7d4","repo":"GoogleContainerTools/jib","slug":"credentials-were-not-sent-to-serverurl-imagen","errorCode":null,"errorMessage":"Credentials were not sent to ${serverUrl}/${imageName}","messagePattern":"Credentials were not sent to (.+?)/(.+?)","errorType":"http","errorClass":"RegistryCredentialsNotSentException","httpStatus":401,"severity":"error","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryEndpointCaller.java","lineNumber":160,"sourceCode":"    } catch (ResponseException ex) {\n      // First, see if the endpoint provider handles an exception as an expected response.\n      try {\n        return registryEndpointProvider.handleHttpResponseException(ex);\n\n      } catch (ResponseException responseException) {\n        if (responseException.getStatusCode() == HttpStatusCodes.STATUS_CODE_BAD_REQUEST\n            || responseException.getStatusCode() == HttpStatusCodes.STATUS_CODE_NOT_FOUND\n            || responseException.getStatusCode()\n                == HttpStatusCodes.STATUS_CODE_METHOD_NOT_ALLOWED) {\n          // The name or reference was invalid.\n          throw newRegistryErrorException(responseException);\n\n        } else if (responseException.getStatusCode() == HttpStatusCodes.STATUS_CODE_FORBIDDEN) {\n          throw new RegistryUnauthorizedException(serverUrl, imageName, responseException);\n\n        } else if (responseException.getStatusCode() == HttpStatusCodes.STATUS_CODE_UNAUTHORIZED) {\n          if (responseException.requestAuthorizationCleared()) {\n            throw new RegistryCredentialsNotSentException(serverUrl, imageName);\n          } else {\n            // Credentials are either missing or wrong.\n            throw new RegistryUnauthorizedException(serverUrl, imageName, responseException);\n          }\n\n        } else {\n          // Unknown\n          throw responseException;\n        }\n      }\n\n    } catch (IOException ex) {\n      logError(\"I/O error for image [\" + serverUrl + \"/\" + imageName + \"]:\");\n      logError(\"    \" + ex.getClass().getName());\n      logError(\"    \" + (ex.getMessage() == null ? \"(null exception message)\" : ex.getMessage()));\n      logErrorIfBrokenPipe(ex);\n\n      if (ex instanceof SSLException) {","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryEndpointCaller.java#L142-L178","documentation":"In the same HTTP-401 handling branch of RegistryEndpointCaller.call, if the server responds 401 and the response indicates the request's Authorization header was not forwarded/accepted (requestAuthorizationCleared()), Jib throws RegistryCredentialsNotSentException ('Credentials were not sent to <serverUrl>/<imageName>').","triggerScenarios":"A registry endpoint call receives 401 with requestAuthorizationCleared() true — typically the auth flow sent no Authorization header (anonymous request) and the registry requires credentials.","commonSituations":"No credentials resolved for the registry (no docker config, no credential helper); credential helper returns empty credentials; intentionally anonymous pull of a private image; environments where ~/.docker/config.json is absent (fresh CI container).","solutions":["Provide credentials for the registry (docker login or Jib authUsername/authPassword or credential helper)","Set up the credential helper binary for the registry (gcr, ecr, acr) and ensure it is on PATH in CI","If the image is public, check the exact repository path/namespace is correct — a typo makes a public image look private"],"exampleFix":"// before: fresh CI container with no docker config\njib:build  // anonymous request -> 401\n// after: mount or create credentials first\necho \"$REGISTRY_PASSWORD\" | docker login registry.example.com -u _json_key --password-stdin\nmvn jib:build","handlingStrategy":"try-catch","validationCode":"// fail fast if no credentials are configured for the registry\nif (dockerConfigLacksEntry(registry) && credentialHelperMissing(registry)) { throw new IllegalStateException(\"Run docker login \" + registry + \" first\"); }","typeGuard":null,"tryCatchPattern":"try { ...registry ops...; } catch (RegistryCredentialsNotSentException e) { throw new BuildException(\"Credentials were not sent to \" + registry + \"/\" + repo + \" — configure docker login or a credential helper\", e); }","preventionTips":["Provision ~/.docker/config.json in CI images","Install registry credential helpers (gcloud, aws ecr get-login, az acr) in build environments","Verify the repository name/namespace spelling to avoid pulling private lookalikes"],"tags":["registry","credentials","authentication"],"backgroundTag":"missing-credentials","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}