Create and manage personal access tokens

A personal access token (PAT) lets you sign in to Docker Hub without your password. You can create several tokens and revoke one without changing your password. From Docker Home, you can view the token list, which shows when each token was last used.

Treat PATs like passwords and keep them secure. Store tokens in a credential manager and never commit them to source code. Before you create a PAT, you must verify your email address.

Tip

For organization-wide automation, consider organization access tokens (OATs), which aren't tied to individual user accounts.

Create a personal access token

When you create a PAT, you choose one repository permission and whether the token can use Cloud Sandboxes. You can combine these to fit the task. For example, a token can use Cloud Sandboxes with no repository access, or it can push images and use Cloud Sandboxes.

To create a PAT:

1. Sign in to Docker Home.
2. Select your avatar in the top-right corner, then select Account settings.
3. Select Personal access tokens.
4. Select Generate new token.
5. Configure your token:
   • Access token description: Enter a name for the token, up to 100 characters. This field is required.
   • Expiration date: Optional. The default is None, which creates a token that doesn't expire.
     • Select 30 days, 90 days, or Custom.
     • With Custom, choose a date and hour up to one year from today.
   • Access permissions: Set a repository permission and, if you need it, Cloud Sandboxes access. Select at least one permission.
     • Repository permissions: The default is Repo Public Read-only.
       • Select one level.
       • Select No repository access when the token should not access repositories.
     • Allow Cloud Sandboxes access: Select this to let the token create and use Cloud Sandboxes. You can add it to any repository permission, or use it with No repository access.
6. Select Generate. Copy the token and save it. Docker shows the token once and doesn't store it. You can't retrieve it after you leave the page.

Sign in with a personal access token

Run docker login with your Docker ID. When the CLI asks for a password, paste the PAT.

$ docker login --username <YOUR_USERNAME>
Password: [paste your PAT here]

If sign-in fails with Incorrect authentication credentials, see Why does sign-in fail with "Incorrect authentication credentials"?.

Update or delete a personal access token

You can rename a token, change its permissions, deactivate it, activate it again, or delete it. You can't edit the expiration date on an existing PAT. Create a new token if you need a different expiration date.

1. Sign in to Docker Home.

2. Select your avatar in the top-right corner, then select Account settings.

3. Select Personal access tokens.

   The list shows each token's description, scope, and status (Active, Inactive, or Revoked). It also shows whether the token is Manual or Auto-generated, when it was created, when it was last used, and when it expires.

4. Select the actions menu on the far right of a token row, then select Deactivate, Activate, Edit, or Delete.

   A deactivated token stops working until you activate it again. Expired and revoked tokens can only be deleted.

5. If you selected Edit, change the Access token description or Access permissions, then select Save token.

Auto-generated tokens

Signing in to Docker Desktop creates a PAT for CLI authentication. These tokens show Auto-generated in the Source column. A token with no description is listed as "Generated by Docker Desktop for CLI usage".

You can have up to five auto-generated tokens on your account. When Docker Desktop creates another one, the least recently used auto-generated token is deleted. A token that has never been used is ranked by when it was created. Tokens you create yourself are not deleted.

You can deactivate or delete an auto-generated token the same way as any other token.

Fair use policy

When using PATs, be aware that excessive token creation may result in throttling or additional charges. Docker reserves the right to impose restrictions on accounts with excessive PAT usage to ensure fair resource allocation and maintain service quality.

Best practices for fair use include:

• Reuse tokens across similar use cases instead of creating many single-purpose tokens
• Delete unused tokens regularly
• Use OATs for organization-wide automation
• Monitor token usage to identify optimization opportunities

Next steps

• Choose a PAT or OAT
• Look up PAT permissions
• Authenticate to Cloud Sandboxes
• Create an OAT
• Turn on two-factor authentication