[Yandex Cloud documentation](../../index.md) > [Yandex Container Registry](../index.md) > [Step-by-step guides](index.md) > Authentication in Container Registry

# Authentication in Container Registry

Before you start using Container Registry, you need to [configure Docker](configure-docker.md) and get authenticated to use the appropriate interface:
* In the **management console**, the minimum required [role](../../iam/concepts/access-control/roles.md) for a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) is `viewer`.
* In the **Docker CLI** or **Yandex Managed Service for Kubernetes**, the minimum required role for a [registry](../concepts/registry.md) or [repository](../concepts/repository.md) is `container-registry.images.puller`.

Assign the required role to the Yandex Cloud user. Read about [authentication methods](#method) and choose the appropriate one.

For more information about roles, see [Access management in Container Registry](../security/index.md).


## Authentication methods {#method}

You can authenticate:

* [As a user](#user):
  * Using an OAuth token (with a 12-month lifetime).
  * Using an IAM token (with a 12 hours lifetime or less).

* [Using a Docker credential helper](#cred-helper).

## Authenticating as a user {#user}

{% list tabs group=registry_auth %}

- Using an OAuth token {#oauth-token}

  {% note info "OAuth token authentication is deprecated" %}
  
  This authentication method will no longer be supported. Consider using [IAM tokens](../../iam/concepts/authorization/iam-token.md) or [API keys](../../iam/concepts/authorization/api-key.md).
  
  {% endnote %}

  {% note info %}

  An OAuth token lives 12 months. After that, you need to [get a new one](https://oauth.yandex.com/authorize?response_type=token&client_id=1a6990aa636648e9b2ef855fa7bec2fb) and get authenticated again.

  {% endnote %}

  1. If you do not have Docker yet, [install it](configure-docker.md).
  1. If you do not have an OAuth token yet, get one by following [this link](https://oauth.yandex.com/authorize?response_type=token&client_id=1a6990aa636648e9b2ef855fa7bec2fb).
  1. Run this command:

     ```bash
     echo <OAuth_token>|docker login \
       --username oauth \
       --password-stdin \
      cr.yandex
     ```

      Where:
      * `<OAuth_token>`: Body of the previously obtained OAuth token.
      * `--username`: Token type. `oauth` means that an OAuth token is used for authentication.
      * `cr.yandex`: The endpoint that Docker will access when working with the image registry. If it not specified, the request will be sent to [Docker Hub](https://hub.docker.com) as the default service.

- Using an IAM token {#iam-token}

  {% note info %}

  The IAM token has a short [lifetime](../../iam/concepts/authorization/iam-token.md#lifetime) of up to 12 hours. This makes it a good method for applications that automatically request an IAM token.

  {% endnote %}

  1. If you do not have Docker yet, [install it](configure-docker.md).
  1. [Get an IAM token](../../iam/operations/iam-token/create.md).
  1. Run this command:

      ```bash
      echo <IAM_token>|docker login \
        --username iam \
        --password-stdin \
        cr.yandex
      ```

      Where:
      * `<IAM_token>`: Body of the previously obtained IAM token.
      * `--username`: Token type. `iam` means that an IAM token is used for authentication.
      * `cr.yandex`: The endpoint that Docker will access when working with the image registry. If it not specified, the request will be sent to [Docker Hub](https://hub.docker.com) as the default service.

{% endlist %}

When running the command, you may get this error message: `docker login is not supported with yc credential helper`.

In such a case, [disable Docker credential helper](#ch-not-use). For more information, see [Troubleshooting in Container Registry](../error/index.md).

## Authenticate using a Docker credential helper {#cred-helper}

The Docker Engine can keep user credentials in an external credentials store. This is more secure than storing credentials in the Docker configuration file. To use a credential store, you need external [Docker credential helper](https://docs.docker.com/engine/reference/commandline/login/#credential-helpers) software.

[Yandex Cloud CLI](../../cli/quickstart.md) uses `docker-credential-yc` as a Docker credential helper for Yandex Cloud. It stores user credentials and allows you to use private Yandex Cloud registries without running the `docker login` command.

### Configuring a credential helper {#ch-setting}

If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

1. Configure Docker to use `docker-credential-yc`:

   ```bash
   yc container registry configure-docker
   ```

   Result:

   ```text
   Credential helper is configured in '/home/<user>/.docker/config.json'
   ```

   The current user’s profile stores the settings.

   {% note warning %}

   The credential helper only works if you use Docker without `sudo`. To learn how to configure Docker to run under the current user without `sudo`, see the [official documentation](https://docs.docker.com/engine/install/linux-postinstall/#manage-docker-as-a-non-root-user).

   {% endnote %}

1. Make sure that Docker is configured.

   The following line must appear in the `${HOME}/.docker/config.json` configuration file:

   ```json
   "cr.yandex": "yc"
   ```

1. You can now use Docker, for example, to [push Docker images](docker-image/docker-image-push.md).

### Additional credential helper features {#ch-feature}

#### Using a credential helper for a different Yandex Cloud CLI profile {#ch-profile}

You can use the credential helper for another profile, without switching from the current one, by running the following command:

```bash
yc container registry configure-docker --profile <profile_name>
```

For more information about Yandex Cloud CLI profile management, see the [step-by-step instructions](../../cli/operations/index.md#profile).

#### Disabling a credential helper {#ch-not-use}

To avoid using a credential helper for authentication, edit the `${HOME}/.docker/config.json` configuration file to delete the `cr.yandex` domain line from the `credHelpers` section.