---
title: '`glab artifact-registry login`'
stage: AI Coding
group: Code Review
info: To determine the technical writer assigned to the Stage/Group associated with this page, see <https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments>
---

<!--
This documentation is auto generated by a script.
Please do not edit this file directly. Run `make gen-docs` instead.
-->

Authenticate a package manager against the GitLab Artifact Registry. (EXPERIMENTAL)

## Synopsis

Configure a package manager to authenticate against the GitLab Artifact
Registry, using a short-lived access token exchanged from your GitLab
session.

Use the flag for your package manager:

- `--docker`: registers `glab` as a Docker credential
  helper for the registry.
- `--maven`: writes a `<server>` block in
  `~/.m2/settings.xml`, keyed by `--registry-alias`.
  Reference it from a `<repository>` carrying the same
  `<id>`.
- `--gradle`: writes `{alias}Url`,
  `{alias}Username`, and `{alias}Password` in
  `~/.gradle/gradle.properties`, where `{alias}` is
  `--registry-alias`.
- `--npm`: writes a `//{host}{path}/:_authToken` entry
  in `~/.npmrc`. You still need to point npm at the registry, with a
  `registry=` or `@scope:registry=` line.
- `--sbt`: writes a `credentials +=` line in
  `~/.sbt/1.0/credentials.sbt`, which assumes a stock sbt 1.x.
  An sbt that moved its global base, with
  `-Dsbt.global.base` or a newer default, does not read that
  file.

Token lifetime:

- `--docker` exchanges a fresh token on every pull or push,
  so `--duration` does not apply.
- Every other flag writes one token, and nothing refreshes it. Run
  the command again before `--duration` elapses. The default
  is 15 minutes and the maximum is 12 hours.

Credential resolution:

- Docker runs the credential helper as its own subprocess, which
  reads your credentials from the configuration file and ignores
  `GITLAB_TOKEN`. This command verifies the login the same
  way, so run `glab auth login` first if no token is stored
  for the host.
- Every other flag does read `GITLAB_TOKEN`. `glab`
  writes the token into each file itself, so the tool can read it
  without fetching credentials itself.

Registry and alias selection:

- Use `--registry` only for a registry the Artifact Registry
  actually backs. If you name a container registry here, it receives the
  wrong token and the error only surfaces on the next pull.
- `--registry-alias` applies to `--maven` and
  `--gradle` only, because `--npm` and
  `--sbt` key their entries on `--registry` itself.
  For `--gradle`, use an alias that is a valid identifier
  in your build script: the default is derived from the registry
  host and contains hyphens, which Groovy cannot interpolate as
  `${...}`.

This feature is an experiment and is not ready for production use.
It might be unstable or removed at any time.
For more information, see
<https://docs.gitlab.com/policy/development_stages_support/>.

```plaintext
glab artifact-registry login [flags]
```

## Examples

```console
# Configure Docker to authenticate against a registry
glab artifact-registry login --docker --registry registry.example.com

# Configure Maven to authenticate against a registry for two hours
glab artifact-registry login --maven --registry https://ar.example.com --duration 2h

# Configure Gradle to authenticate against a registry for two hours
glab artifact-registry login --gradle --registry https://ar.example.com --duration 2h

# Configure npm to authenticate against a registry for two hours
glab artifact-registry login --npm --registry https://ar.example.com --duration 2h

# Configure sbt to authenticate against a registry for two hours
glab artifact-registry login --sbt --registry https://ar.example.com --duration 2h

```

## Options

```plaintext
      --docker                  Configure Docker to authenticate against the registry. Writes to $DOCKER_CONFIG, or ~/.docker when it is unset.
      --duration duration       How long the exchanged token should remain valid. Ignored for --docker. (default 15m0s)
      --gradle                  Configure Gradle to authenticate against the registry. Writes to ~/.gradle/gradle.properties.
      --hostname string         GitLab hostname to request the token from. Defaults to the configured GitLab instance.
      --maven                   Configure Maven to authenticate against the registry. Writes to ~/.m2/settings.xml.
      --npm                     Configure npm to authenticate against the registry. Writes to ~/.npmrc.
      --registry string         Registry to authenticate against. For --docker, a bare hostname; for others, typically a URL.
      --registry-alias string   Alias/ID to register the registry under (Maven/Gradle only). Defaults to a name derived from --registry.
      --sbt                     Configure sbt to authenticate against the registry. Writes to ~/.sbt/1.0/credentials.sbt.
```

## Options inherited from parent commands

```plaintext
  -h, --help   Show help for this command.
```
