[tencent-tcr.newAdapter] Please use SecretId/SecretKey, NOT

Error message

[tencent-tcr.newAdapter] Please use SecretId/SecretKey, NOT docker login Username/Password

What it means

Returned by newAdapter for the Tencent TCR adapter (src/pkg/reg/adapter/tencentcr/adapter.go:100) when registry.Credential.AccessKey does not look like a Tencent Cloud SecretId: isSecretID (src/pkg/reg/adapter/tencentcr/auth.go:98) requires the key to start with 'AKID' or 'IKID'. The adapter needs the SecretId/SecretKey pair to call the Tencent Cloud API (temporary docker-login tokens are generated from it), so docker login credentials are rejected up front.

Source

Thrown at src/pkg/reg/adapter/tencentcr/adapter.go:100

type adapter struct {
	*native.Adapter
	registryID *string
	regionName *string
	tcrClient  *tcr.Client
	pageSize   *int64
	client     *commonhttp.Client
	registry   *model.Registry
}

/**
	* Implement Adapter Interface
**/
var _ adp.Adapter = &adapter{}

func newAdapter(registry *model.Registry) (a *adapter, err error) {
	if !isSecretID(registry.Credential.AccessKey) {
		err = errors.New("[tencent-tcr.newAdapter] Please use SecretId/SecretKey, NOT docker login Username/Password")
		log.Debugf("[tencent-tcr.newAdapter] error=%v", err)
		return
	}

	// Query TCR instance info via endpoint.
	var registryURL *url.URL
	registryURL, _ = url.Parse(registry.URL)

	// only validate registryURL.Host in non-UT scenario
	if os.Getenv("UTTEST") != "true" {
		if !strings.Contains(registryURL.Host, ".tencentcloudcr.com") {
			log.Errorf("[tencent-tcr.newAdapter] errInvalidTcrEndpoint=%v", err)
			return nil, errInvalidTcrEndpoint
		}
	}

	realm, service, err := util.Ping(registry)
	log.Debugf("[tencent-tcr.newAdapter] realm=%s, service=%s error=%v", realm, service, err)

View on GitHub (pinned to 7b2fd08cc5)

Solutions

Create a Tencent Cloud API key pair (CAM > Access Keys) and use the SecretId (starts with AKID) as AccessKey and the SecretKey as AccessSecret.
If a temporary docker login credential is all you have, generate it from the console/API with your SecretId/SecretKey — do not feed the temp username into this adapter.
Verify the credential shape before creating the adapter (see validationCode for a prefix check).
Grant the CAM user QcloudTCRFullAccess or scoped TCR permissions so subsequent API calls succeed.

Example fix

// before
registry.Credential = &model.Credential{
    AccessKey:   "temp-username-1600000000",  // docker login temp username
    AccessSecret: "temp-password",
}

// after
registry.Credential = &model.Credential{
    AccessKey:   "AKIDxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", // SecretId
    AccessSecret: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",    // SecretKey
}

Defensive patterns

Strategy: validation

Validate before calling

func looksLikeSecretID(key string) bool {
	return strings.HasPrefix(key, "AKID") || strings.HasPrefix(key, "IKID")
}
if !looksLikeSecretID(registry.Credential.AccessKey) {
	return fmt.Errorf("provide Tencent Cloud SecretId/SecretKey, not docker login credentials")
}

Type guard

func isTencentSecretCredential(c *model.Credential) bool {
	return c != nil && (strings.HasPrefix(c.AccessKey, "AKID") || strings.HasPrefix(c.AccessKey, "IKID"))
}

Try / catch

a, err := tencentcr.NewAdapter(registry)
if err != nil {
	if strings.Contains(err.Error(), "Please use SecretId/SecretKey") {
		// credential config error: switch to a Tencent Cloud API key pair
	}
	return nil, err
}

Prevention

Create the credential in CAM (Access Keys), not from the console 'docker login' temp command.
SecretId values start with AKID (or IKID for some accounts) — use that as a sanity check before saving the endpoint.
Grant the key TCR permissions so later API calls succeed.
Store the SecretKey via a secret manager, never in plaintext config.

When it happens

Trigger: Creating a tencentcr adapter with Credential.AccessKey set to a docker login username (e.g. the TCR temporary username from 'docker login', or a random user) instead of a Tencent Cloud API SecretId. Any key not prefixed AKID/IKID triggers it, including an empty AccessKey.

Common situations: Users pasting the temporary username/password printed by the TCR console 'Generate login command' into the endpoint credential fields; using CAM-role assumed credentials without the SecretId prefix; leaving credentials empty because docker pull worked anonymously; switching from the docker-hub adapter where username/password is correct.

Related errors

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/87d77f5b0d8d58f1. Report an issue: GitHub.