---
name: "glab-artifact-registry-login"
section: "1"
platform: "linux"
package: "glab"
version: "1.126.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/glab-artifact-registry-login"
---

# glab-artifact-registry-login(1)

Authenticate a package manager against the GitLab Artifact Registry. (EXPERIMENTAL)

## NAME

glab-artifact-registry-login - Authenticate a package manager against the GitLab Artifact Registry. (EXPERIMENTAL)

## SYNOPSIS

**glab artifact-registry login \[flags\]**

## DESCRIPTION

Configure a package manager to authenticate against the GitLab Artifact Registry, using a short-lived access token exchanged from your GitLab session.

Use the flag for your package manager:

- •

  **--docker**: registers **glab** as a Docker credential helper for the registry.

- •

  **--maven**: writes a **\<server\>** block in **~/.m2/settings.xml**, or **--config-file**, keyed by **--registry-alias**. Reference it from a **\<repository\>** carrying the same **\<id\>**. The token is written in plain text, so keep a **--config-file** out of version control.

- •

  **--gradle**: writes **{alias}Url**, **{alias}Username**, and **{alias}Password** in **~/.gradle/gradle.properties**, where **{alias}** is **--registry-alias**.

- •

  **--npm**: writes a **//{host}{path}/:\_authToken** entry in **~/.npmrc**. You still need to point npm at the registry, with a **registry=** or **@scope:registry=** line.

- •

  **--yarn**: writes an **npmRegistries** entry with **npmAuthToken** and **npmAlwaysAuth** in **~/.yarnrc.yml**, for Yarn 2 and later. Set an **npmRegistryServer** that matches **--registry**. Rewriting the file can change its formatting, like indentation, blank lines, and line endings.

- •

  **--sbt**: writes a **credentials +=** line in **~/.sbt/1.0/credentials.sbt**, which sbt 1.x reads, and the same line in **2/credentials.sbt** in the sbt 2.x global base, which sbt 2.x reads. That base is **~/.config/sbt**, or **%LOCALAPPDATA%\\sbt** on Windows, unless **SBT\_CONFIG\_HOME** or **XDG\_CONFIG\_HOME** moves it. On Windows it also writes **%LOCALAPPDATA%\\sbt\\credentials.sbt**. The **sbt.bat** of sbt 2.x points every build it starts, on either version, at that file only, even when **SBT\_CONFIG\_HOME** is set. The **sbt.version** in a project's **project/build.properties** decides which file its build reads. An sbt started with any other **-Dsbt.global.base** reads none of them. An sbt shell or sbt 2.x server that is already running keeps the credentials it loaded, so run **reload** in it, or **sbt shutdown**, after you log in. To write a different file, pass it with **--config-file**. It must be a **.sbt** file that sbt loads, not a properties file such as **~/.sbt/.credentials**.

Token lifetime:

- •

  **--docker** exchanges a fresh token on every pull or push, so **--duration** does not apply.

- •

  Every other flag writes one token, and nothing refreshes it. Run the command again before **--duration** elapses. The default is 15 minutes and the maximum is 12 hours.

Credential resolution:

- •

  Docker runs the credential helper as its own subprocess, which reads your credentials from the configuration file and ignores **GITLAB\_TOKEN**. This command verifies the login the same way, so run **glab auth login** first if no token is stored for the host.

- •

  Every other flag does read **GITLAB\_TOKEN**. **glab** writes the token into each file itself, so the tool can read it without fetching credentials itself.

Registry and alias selection:

- •

  Use **--registry** only for a registry the Artifact Registry actually backs. If you name a container registry here, it receives the wrong token and the error only surfaces on the next pull.

- •

  **--registry-alias** applies to **--maven** and **--gradle** only, because **--npm**, **--sbt**, and **--yarn** key their entries on **--registry** itself. For **--gradle**, use an alias that is a valid identifier in your build script: the default is derived from the registry host and contains hyphens, which Groovy cannot interpolate as **${...}**.

This feature is an experiment and is not ready for production use. It might be unstable or removed at any time. For more information, see https://docs.gitlab.com/policy/development\_stages\_support/.

## OPTIONS

**--config-file**=""\
 	File to write (Maven/sbt only). Defaults to ~/.m2/settings.xml for --maven and the sbt 1.x and 2.x global bases for --sbt, where it replaces every file --sbt writes.

**--docker**\[=false\]\
 	Configure Docker to authenticate against the registry. Writes to $DOCKER\_CONFIG, or ~/.docker when it is unset.

**--duration**=15m0s\
 	How long the exchanged token should remain valid. Ignored for --docker.

**--gradle**\[=false\]\
 	Configure Gradle to authenticate against the registry. Writes to ~/.gradle/gradle.properties.

**--hostname**=""\
 	GitLab hostname to request the token from. Defaults to the configured GitLab instance.

**--maven**\[=false\]\
 	Configure Maven to authenticate against the registry. Writes to ~/.m2/settings.xml.

**--npm**\[=false\]\
 	Configure npm to authenticate against the registry. Writes to ~/.npmrc.

**--registry**=""\
 	Registry to authenticate against. For --docker, a bare hostname; for others, typically a URL.

**--registry-alias**=""\
 	Alias/ID to register the registry under (Maven/Gradle only). Defaults to a name derived from --registry.

**--sbt**\[=false\]\
 	Configure sbt to authenticate against the registry. Writes credentials.sbt to the sbt 1.x and 2.x global bases.

**--yarn**\[=false\]\
 	Configure Yarn 2 or later to authenticate against the registry. Writes to ~/.yarnrc.yml. For Yarn 1, use --npm.

## OPTIONS INHERITED FROM PARENT COMMANDS

**-h**, **--help**\[=false\]\
 	Show help for this command.

## EXAMPLE

```
# Configure Docker to authenticate against a registry
glab artifact-registry login --docker --registry registry.example.com
# Configure Maven to authenticate against a registry for two hours
glab artifact-registry login --maven --registry https://ar.example.com --duration 2h
# Configure Gradle to authenticate against a registry for two hours
glab artifact-registry login --gradle --registry https://ar.example.com --duration 2h
# Configure npm to authenticate against a registry for two hours
glab artifact-registry login --npm --registry https://ar.example.com --duration 2h
# Configure Yarn 2 or later to authenticate against a registry for two hours
glab artifact-registry login --yarn --registry https://ar.example.com --duration 2h
# Configure sbt to authenticate against a registry for two hours
glab artifact-registry login --sbt --registry https://ar.example.com --duration 2h
# Configure Maven through a settings.xml passed to mvn with -s
glab artifact-registry login --maven --registry https://ar.example.com --config-file ~/.m2/ci-settings.xml
```

## SEE ALSO

**[glab-artifact-registry(1)](/glab-artifact-registry/1.md)**