{"record":{"id":"3146363976ac2466","repo":"GoogleContainerTools/jib","slug":"credentials-were-not-sent-to-registryurl-imag","errorCode":null,"errorMessage":"Credentials were not sent to ${registryUrl}/${imageName}","messagePattern":"Credentials were not sent to (.+?)/(.+?)","errorType":"exception","errorClass":"RegistryCredentialsNotSentException","httpStatus":401,"severity":"error","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java","lineNumber":303,"sourceCode":"        AuthenticationResponseTemplate responseJson =\n            JsonTemplateMapper.readJson(response.getBody(), AuthenticationResponseTemplate.class);\n\n        if (responseJson.getToken() == null) {\n          throw new RegistryAuthenticationFailedException(\n              registryUrl,\n              imageName,\n              \"Did not get token in authentication response from \"\n                  + getAuthenticationUrl(credential, repositoryScopes)\n                  + \"; parameters: \"\n                  + getAuthRequestParameters(credential, repositoryScopes));\n        }\n        return Authorization.fromBearerToken(responseJson.getToken());\n      }\n\n    } catch (ResponseException ex) {\n      if (ex.getStatusCode() == HttpStatusCodes.STATUS_CODE_UNAUTHORIZED\n          && ex.requestAuthorizationCleared()) {\n        throw new RegistryCredentialsNotSentException(registryUrl, imageName);\n      }\n      throw new RegistryAuthenticationFailedException(registryUrl, imageName, ex);\n\n    } catch (IOException ex) {\n      throw new RegistryAuthenticationFailedException(registryUrl, imageName, ex);\n    }\n  }\n}\n","sourceCodeStart":285,"sourceCodeEnd":312,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java#L285-L312","documentation":"During token authentication, if the auth server responds HTTP 401 and the response indicates that request authorization was cleared (credentials were not forwarded), Jib throws RegistryCredentialsNotSentException. This means the credentials Jib had were never transmitted/accepted by the auth endpoint, typically because none were provided or the server stripped them.","triggerScenarios":"authenticate() catches a ResponseException with status 401 whose requestAuthorizationCleared() is true while authenticating against registryUrl/imageName.","commonSituations":"Anonymous build against a private registry where no credential helpers/docker config supply credentials; docker credential helper broken or not configured so Jib sends no Authorization header; misconfigured credential store making Jib fall back to anonymous auth.","solutions":["Configure credentials: run 'docker login' for the registry or set up a credential helper (gcr, ecr, acr) so Jib can find them","Check ~/.docker/config.json contains an auths entry or credHelpers entry for the target registry","If the registry truly allows anonymous pull, ensure the image/repository is public","Verify the auth server realm accepts Basic auth rather than rejecting all forwarded credentials"],"exampleFix":"// before: no credentials configured\ndocker login myregistry.example.com  // run this outside the build\n// after: credentials available so token request includes Authorization header\necho \"$PASSWORD\" | docker login myregistry.example.com -u user --password-stdin","handlingStrategy":"validation","validationCode":"// ensure credentials exist before building\nif (!Files.readAllLines(Path.of(System.getProperty(\"user.home\"), \".docker\", \"config.json\")).stream().anyMatch(l -> l.contains(\"registry.example.com\"))) { throw new IllegalStateException(\"Run docker login first\"); }","typeGuard":null,"tryCatchPattern":"try { client.pullBlob(...); } catch (RegistryCredentialsNotSentException e) { throw new BuildException(\"No credentials for \" + registry + \" — run docker login\", e); }","preventionTips":["Always docker login (or configure credHelpers) before private registry operations","In CI, provision docker/config.json as a build step","Validate credential helper output non-empty"],"tags":["registry","authentication","credentials"],"backgroundTag":"missing-credentials","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}