See what a registry token actually grants. A failed pull is far more often a scope problem than an authentication problem, and the scope is written inside the token.
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Decode. Nothing leaves this tab.
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
Push means it can replace a tag, which is enough to change what gets deployed
{"token":"eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJjaS1ib3QiLCJhY2Nlc3MiOlt7InR5cGUiOiJyZXBvc2l0b3J5IiwibmFtZSI6ImFjbWUvYXBwIiwiYWN0aW9ucyI6WyJwdWxsIiwicHVzaCJdfV19.sig"}Rate limited per source IP, which a shared CI pool exhausts collectively
eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIiLCJhY2Nlc3MiOlt7InR5cGUiOiJyZXBvc2l0b3J5IiwibmFtZSI6ImxpYnJhcnkvYWxwaW5lIiwiYWN0aW9ucyI6WyJwdWxsIl19XX0.sig
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
A 401 is authentication and a 403 is scope. If a token was issued at all, the credentials worked and the problem is what it grants.
Instead:Decode it and compare the access claims against the repository you are pulling.
The anonymous rate limit is counted per source IP, so a shared runner pool exhausts it collectively and pulls start failing for everybody.
Instead:Authenticate even for public images. The limit is then per account and much higher.
It is a working credential until it expires, and issue trackers keep history and send email.
Instead:Paste the decoded claims instead. Nothing in them is secret.
The token you get back can be perfectly valid and grant nothing. Reading the access claims is faster than re-checking credentials that were never wrong.
Each one is a type, a repository name and a list of actions. A pull needs pull on that exact repository name, spelled as the registry has it, including the library/ prefix on Docker Hub official images. An empty access array means the requested scope matched nothing the account may reach.
Tags are mutable, so push access to a repository is enough to have a different image deployed the next time anything pulls, with nothing visible in any repository. Treat a token carrying push like a deploy key.
With no subject the registry issued it without authentication. On Docker Hub that means the anonymous limit, counted per source address, so a NAT gateway or a CI runner pool shares one budget across everybody behind it. Authenticating even for public images moves you to a higher limit counted per account.
The v2 spec does not require one. Several registries and proxies return an opaque string that means something only to the issuer, in which case the scope is whatever was requested rather than something the token states.
Verifying it needs the registry's public key, which means a network request this page deliberately does not make. So these are the claims the token makes, which is what you want when working out why a pull was refused, and not proof it is genuine.
For as long as it is valid, anybody holding it can do whatever the scope allows with no further authentication. Decoding it here is safe because nothing leaves the tab. Pasting it into a ticket or a chat is not.