Create access token API Reference

POST

/tenants/{tenant}/registries/{name}/tokens

curl --request POST \
  --url https://api.kupe.cloud/api/v1/tenants/acme/registries/registry/tokens \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "access": "pull", "displayName": "GitHub Actions", "expiresInDays": 90 }'

Create an access token for the registry, for CI or anything else that pulls or pushes images without a person signed in. access is pull, or push (which includes pull); expiresInDays is 1 to 365, default 90.

Authorizations

• BearerAuth

Parameters

Path Parameters

tenant

required

string

Tenant name

name

required

string

Registry name: always registry

Request Body

Access token

Media type application/json

object

access

Pull, or push (which includes pull).

string

Allowed values: pull push

Example

pull

displayName

A name to recognise the token by: 1 to 128 printable characters.

string

Example

GitHub Actions

expiresInDays

Days until the token stops working: 1 to 365, default 90.

integer

Example

90

Responses

201

Access token created; the secret is shown only here

Media type application/json

object

access

string

Allowed values: pull push

createdAt

string

createdBy

string

displayName

string

expiresAt

string

id

string

kind

string

Allowed values: token session

registry

Registry is the registry host to sign in to.

string

secret

Secret is the password for the registry: 49 characters, returned once. Store it now; it cannot be retrieved again. Its format is published for secret scanning (see the security docs).

string

status

object

phase

Phase is empty or Pending until the token is issued (seconds), then Ready.

string

Allowed values: Pending Ready Failed

username

Username is the registry username the token is issued under.

string

Example

{
  "access": "pull",
  "createdAt": "2026-10-21T10:00:00Z",
  "createdBy": "alice@acme.com",
  "displayName": "GitHub Actions",
  "expiresAt": "2027-01-19T10:00:00Z",
  "id": "rt-0a1b2c3d4e5f6a7b",
  "kind": "token",
  "registry": "registry.kupe.cloud",
  "secret": "<shown once>",
  "status": {
    "phase": "Pending"
  },
  "username": "kupe+acme+tok-0a1b2c3d4e5f6a7b"
}

400

Validation error, or an expiry out of range (code REGISTRY_TOKEN_EXPIRY_INVALID, field spec.expiresAt)

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

401

Missing or invalid authentication

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

403

Admin access required; the creator is no longer a member (code REGISTRY_TOKEN_CREATOR_NOT_MEMBER) or no longer an admin (code REGISTRY_TOKEN_PUSH_ADMIN_ONLY)

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

404

Registry not found, or the registry is not enabled (code registries_unavailable)

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

409

The registry already has 50 access tokens (code REGISTRY_TOKEN_LIMIT_REACHED), the registry is being deleted (code terminating), or the tenant is suspended (code tenant_suspended), awaiting a payment method (code payment_setup_required) or being deleted (code tenant_terminating)

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

429

Rate limit exceeded

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}