{"record":{"id":"f2f803af38068eff","repo":"jdx/mise","slug":"auth-for-key-is-not-user-password","errorCode":null,"errorMessage":"`auth` for {key} is not `user:password`","messagePattern":"`auth` for (.+?) is not `user:password`","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/oci/auth.rs","lineNumber":177,"sourceCode":"            Err(e) => {\n                debug!(\"credsStore helper {helper} has no credentials for {registry}: {e}\");\n            }\n        }\n    }\n\n    Ok(None)\n}\n\nfn credential_from_entry(entry: &AuthEntry, key: &str) -> Result<Option<Credential>> {\n    let (mut username, mut secret) = (entry.username.clone(), entry.password.clone());\n    if let Some(auth) = entry.auth.as_deref().filter(|a| !a.is_empty()) {\n        let decoded = BASE64_STANDARD\n            .decode(auth.trim())\n            .wrap_err_with(|| format!(\"decoding base64 `auth` for {key}\"))?;\n        let decoded = String::from_utf8(decoded)\n            .wrap_err_with(|| format!(\"`auth` for {key} is not valid UTF-8\"))?;\n        let Some((u, p)) = decoded.split_once(':') else {\n            bail!(\"`auth` for {key} is not `user:password`\");\n        };\n        username = Some(u.to_string());\n        secret = Some(p.to_string());\n    }\n    // An identity token (docker.io \"Docker Desktop\" login flow) replaces the\n    // password; the username from `auth` is ignored by registries in this\n    // mode but `<token>` is the conventional placeholder.\n    if let Some(token) = entry.identity_token.as_deref().filter(|t| !t.is_empty()) {\n        return Ok(Some(Credential {\n            username: \"<token>\".to_string(),\n            secret: token.to_string(),\n        }));\n    }\n    match (username, secret) {\n        (Some(u), Some(p)) => Ok(Some(Credential {\n            username: u,\n            secret: p,\n        })),","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/oci/auth.rs#L159-L195","documentation":"When reading Docker-style registry credentials (e.g. `~/.docker/config.json`), the `auth` field must be base64 of `username:password`. `credential_from_entry` decodes it and splits on the first `:`; if no colon exists, it bails because the credential cannot be split into username/secret.","triggerScenarios":"Calling OCI-authenticated operations with a docker config entry whose `auth` field decodes to a string without a `:` — e.g. `auth` was set to a raw token, only a username, or base64 of a password without the username prefix.","commonSituations":"Users pasting an access token directly into `auth`; manually crafting config.json entries; credential created by tooling that only stores the password; corrupted or truncated auth values.","solutions":["Set `auth` to base64 of `username:password` (`echo -n 'user:pass' | base64`) in the registry config entry","Use `docker login` (or the registry CLI) to regenerate the credential entry correctly","If using an identity token flow, put the token in the `identitytoken` field instead of `auth`","Remove the malformed entry and re-authenticate against the registry"],"exampleFix":"# before (config.json)\n\"auth\": \"c2VjcmV0\"  // base64 of just the password\n# after\n\"auth\": \"dXNlcjpzZWNyZXQ=\"  // base64 of \"user:secret\"","handlingStrategy":"validation","validationCode":"use base64::Engine;\nfn auth_is_user_password(auth: &str) -> bool {\n    base64::engine::general_purpose::STANDARD\n        .decode(auth.trim()).ok()\n        .and_then(|b| String::from_utf8(b).ok())\n        .is_some_and(|s| s.contains(':'))\n}","typeGuard":null,"tryCatchPattern":"match result {\n    Err(e) if e.to_string().contains(\"is not `user:password`\") => {\n        // re-run `docker login` to regenerate the auth entry, then retry\n    }\n    other => other?,\n}","preventionTips":["Never paste raw tokens into the `auth` field; always base64-encode `user:password`","Use `docker login` to generate config.json entries instead of hand-crafting them","Use the `identitytoken` field for token-based flows rather than `auth`","Validate registry config entries after editing or migrating them"],"tags":["oci","auth","docker","credentials"],"backgroundTag":"invalid-argument-format","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}