Quay "unauthorized: access to the requested resource is not authorized" in CI

By Kaveh Alemi·Latchkey

Quay rejected the request because the credentials do not have rights to that repository. Quay typically uses robot accounts with per-repository permissions, so a robot without Write on the repo, or a missing login, produces this error. Grant the robot Write and log in with its token.

What this error means

docker push to quay.io/org/app fails with "unauthorized: access to the requested resource is not authorized" even after a docker login that reported success.

unauthorized: access to the requested resource is not authorized

Common causes

The robot account lacks Write on the repository

Quay scopes permissions per repository. A robot with only Read, or no grant on this repo, cannot push.

Wrong or missing robot credentials

The login used a user without access, or no login ran, so Quay denies the push.

How to fix it

Use a robot account with Write permission

1. Create a robot account under the org in Quay.
2. Grant the robot Write permission on the target repository.
3. Log in with the robot name and token before pushing.

- uses: docker/login-action@v3
  with:
    registry: quay.io
    username: ${{ secrets.QUAY_ROBOT_USER }}
    password: ${{ secrets.QUAY_ROBOT_TOKEN }}

Check repository visibility and team grants

Confirm the repo grants the robot (or its team) Write, not just Read, in the Quay repository settings.

How to prevent it

• Grant CI robots Write only on the repos they push.
• Store robot tokens as secrets, not in committed config.
• Review per-repository permissions when access errors appear.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation