# skopeo login: Authenticate to a Registry

> skopeo login authenticates to a container registry for later copy/inspect. Reference for --username, --password-stdin, authfile, and CI errors.

Source: https://latchkey.dev/learn/command-reference/skopeo-login  
Updated: 2026-06-30

skopeo login stores registry credentials so later skopeo (and podman) commands authenticate without repeating them.

Rather than passing --creds on every command, log in once. skopeo writes the token to an auth file that subsequent commands reuse, the same file podman and buildah read.

## What it does

skopeo login authenticates to a registry and writes the credential to an auth file (by default $XDG_RUNTIME_DIR/containers/auth.json or a path you set with --authfile). Later skopeo copy and inspect calls pick up that credential automatically.

## Common usage

```Terminal
echo "$GHCR_TOKEN" | skopeo login ghcr.io \
  --username "$GITHUB_ACTOR" --password-stdin
# scope the credential to a CI-local auth file
skopeo login ghcr.io -u "$USER" --password-stdin \
  --authfile ./auth.json < token.txt
```

## Options

| Flag | What it does |
| --- | --- |
| -u, --username <user> | Registry username |
| -p, --password <pass> | Password (prefer --password-stdin) |
| --password-stdin | Read the password from stdin (safer in CI) |
| --authfile <file> | Where to store the credential |
| --tls-verify=false | Disable TLS verification (testing only) |

## In CI

Always use --password-stdin and pipe the secret in, so the token does not appear in the process list or logs. Set --authfile to a job-local path on shared runners to avoid leaking credentials into a shared default location.

## Common errors in CI

"error logging into registry: invalid username/password" means wrong credentials or an expired token. "unauthorized: authentication required" on a later copy means login wrote to a different authfile than the copy reads; set --authfile consistently or export REGISTRY_AUTH_FILE. Passing -p on the command line risks leaking the secret in logs.

## FAQ

### skopeo login: Authenticate to a Registry?

Rather than passing --creds on every command, log in once. skopeo writes the token to an auth file that subsequent commands reuse, the same file podman and buildah read.

### What it does?

skopeo login authenticates to a registry and writes the credential to an auth file (by default $XDG_RUNTIME_DIR/containers/auth.json or a path you set with --authfile). Later skopeo copy and inspect calls pick up that credential automatically.

### In CI?

Always use --password-stdin and pipe the secret in, so the token does not appear in the process list or logs. Set --authfile to a job-local path on shared runners to avoid leaking credentials into a shared default location.

### Common errors in CI?

"error logging into registry: invalid username/password" means wrong credentials or an expired token. "unauthorized: authentication required" on a later copy means login wrote to a different authfile than the copy reads; set --authfile consistently or export REGISTRY_AUTH_FILE.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt