---
title: How Temporary Credentials Work Through Vultr Container Registry
url: https://docs.vultr.com/platform/iam/product-integrations/container-registry-auth/temporary-credentials
description: Understand how Vultr Container Registry derives Docker credential scope from IAM policy and mints credentials.
publish_date: 2026-10-14T13:46:17.297532Z
last_updated: 2026-10-23T20:36:35.264560Z
---

# How Temporary Credentials Work Through Vultr Container Registry

Account-wide API keys and long-lived registry passwords are difficult to scope and rotate. A leaked key or password exposes every registry it can reach until someone notices and replaces it. Vultr Container Registry avoids this by issuing short-lived Docker credentials on demand, with a scope that matches the caller's IAM policy.

Follow this guide to understand how scope is determined, how requests for one or many registries are handled, and how to read the response when you mint credentials using the Vultr API.

> [!NOTE]
> This guide assumes you have already enabled IAM authentication for your registry. See [How to Enable IAM Authentication for Vultr Container Registry](https://docs.vultr.com/platform/iam/product-integrations/container-registry/enable-iam-auth) for the setup steps.

## How Credentials Are Derived from IAM

When you send a mint request, Vultr Container Registry evaluates the caller's effective IAM permissions and issues credentials that match them. Policy evaluation has already resolved any `Deny` statements, so the scope reflects only what the caller is allowed to do.

Two kinds of permission are involved:

* `container.registry.GetCredentials` is a resource-independent capability gate. It allows the caller to use the discover and mint endpoints, and you grant it on `*`, not per registry.
* `container.registry.Pull` or `container.registry.Push` on a registry determines the scope of the credentials minted for that registry. `Pull` gives read-only credentials, and `Push` gives read/write credentials.

Credentials are allow-only. The endpoint never grants more than the caller's IAM permissions allow.

## Minting for One or Many Registries

The mint endpoint accepts three forms of request, depending on how many registries you want credentials for.

1. To mint for a single registry, pass `registry` with the registry's ID. Replace `REGISTRY_ID` with your registry's ID.

    ```console
    $ curl "https://api.vultr.com/v2/container-registry/docker-credentials" \
        -X POST \
        -H "Authorization: Bearer ${VULTR_API_KEY}" \
        -H "Content-Type: application/json" \
        -d '{
            "registry": "REGISTRY_ID",
            "expiry_seconds": 3600
        }'
    ```

1. To mint for a specific set of registries, pass `registries` as a list of IDs. Replace `REGISTRY_ID_1` and `REGISTRY_ID_2` with your registry IDs.

    ```console
    $ curl "https://api.vultr.com/v2/container-registry/docker-credentials" \
        -X POST \
        -H "Authorization: Bearer ${VULTR_API_KEY}" \
        -H "Content-Type: application/json" \
        -d '{
            "registries": ["REGISTRY_ID_1", "REGISTRY_ID_2"],
            "expiry_seconds": 3600
        }'
    ```

1. To mint for every registry the caller can access, omit both `registry` and `registries`. Vultr Container Registry issues one credential per grantable registry, with no fixed cap.

    ```console
    $ curl "https://api.vultr.com/v2/container-registry/docker-credentials" \
        -X POST \
        -H "Authorization: Bearer ${VULTR_API_KEY}" \
        -H "Content-Type: application/json" \
        -d '{
            "expiry_seconds": 3600
        }'
    ```

A successful mint returns an HTTP `201 Created` response, including when you mint credentials for multiple registries in a single request.

## Reading the Response

The response contains three fields.

* **auths:** A Docker-compatible map of credentials, keyed by registry host, such as `REGISTRY_HOST`. You can merge this map into `~/.docker/config.json` or decode an entry to log in.
* **minted:** The scope actually granted for each registry, such as `["pull"]` or `["pull", "push"]`.
* **errors:** Any registry that Vultr Container Registry could not mint credentials for, along with the reason.

When a request covers more than one registry, Vultr Container Registry authorizes each registry independently. If a registry's grant can't satisfy the requested scope, Vultr Container Registry skips it and reports it in `errors`, and the mint still succeeds for the remaining registries. If every registry fails, the request returns `502`.