Harbor "unauthorized: authentication required" on push in CI

By Daniel Zoghalchali·Latchkey

The Harbor registry rejected the push because the client is not authenticated. docker login did not run, or the robot account name/secret is wrong or expired. Harbor requires auth even for pushes to public projects.

What this error means

docker push fails with "unauthorized: authentication required" or "denied: unauthorized to access repository". A prior docker login may have silently failed.

Docker

The push refers to repository [harbor.example.com/acme/app]
denied: unauthorized: authentication required

Common causes

No docker login before push

The job pushes without authenticating, so Harbor returns unauthorized.

A wrong or expired robot account secret

The robot account name (like robot$acme+ci) or its token is wrong or past its expiry, so login does not grant push.

How to fix it

Log in with the robot account

Create a Harbor robot account scoped to the project with push permission.
Run docker login with the robot name and token from CI secrets.
Push after a successful login.

Terminal

echo "$HARBOR_ROBOT_TOKEN" | docker login harbor.example.com \
  -u 'robot$acme+ci' --password-stdin
docker push harbor.example.com/acme/app:1.0.0

Check the robot token expiry

Harbor robot tokens can expire; regenerate the robot account and update the secret if login stops working.

How to prevent it

Use a project-scoped robot account for CI pushes.
Set a long or no expiry and rotate the secret deliberately.
Fail the job if docker login returns non-zero before pushing.

Frequently asked questions

What causes ""unauthorized: authentication required""?