Create and manage personal access tokens
A personal access token (PAT) lets you sign in to Docker Hub without your password. Use a token for the Docker CLI, scripts, continuous integration (CI) jobs, and other tools that should act as your account.
Each token has one permission level. You can create several tokens and revoke one without changing your password. The token list shows when each token was last used.
When two-factor authentication is turned on, or single sign-on is enforced, password sign-in to the CLI isn't supported. Sign in with a PAT instead.
TipFor organization-wide automation, consider organization access tokens (OATs), which aren't tied to individual user accounts.
Create a personal access token
Treat PATs like passwords and keep them secure. Store tokens in a credential manager and never commit them to source code. Before you create a PAT, you must verify your email address. To create a PAT:
- Sign in to Docker Home.
- Select your avatar in the top-right corner, then select Account settings.
- Select Personal access tokens.
- Select Generate new token.
- Configure your token:
- Access token description: Enter a name for the token, up to 100 characters. This field is required.
- Expiration date: Optional. Select 30 days, 90 days, or Custom. With Custom, choose a date and hour up to one year from today. The default, None, creates a token that doesn't expire.
- Access permissions: Select one permission level. The default is Repo Public Read-only.
- Select Generate. Copy the token and save it. Docker shows the token once and doesn't store it. You can't retrieve it after you leave the page.
Sign in
Run docker login with your Docker ID. When the CLI asks for a
password, paste the PAT.
$ docker login --username <YOUR_USERNAME>
Password: [paste your PAT here]
If sign-in fails with Incorrect authentication credentials, see
Why does sign-in fail with "Incorrect authentication credentials"?.
Update or delete
You can rename a token, change its permissions, deactivate it, activate it again, or delete it. You can't edit the expiration date on an existing PAT. Create a new token if you need a different expiration date.
Sign in to Docker Home.
Select your avatar in the top-right corner, then select Account settings.
Select Personal access tokens.
The list shows each token's description, scope, and status (Active, Inactive, or Revoked). It also shows whether the token is Manual or Auto-generated, when it was created, when it was last used, and when it expires.
Select the actions menu on the far right of a token row, then select Deactivate, Activate, Edit, or Delete.
A deactivated token stops working until you activate it again. Expired and revoked tokens can only be deleted.
If you selected Edit, change the Access token description or Scopes, then select Save token.
Auto-generated tokens
Signing in to Docker Desktop creates a PAT for CLI authentication. These tokens show Auto-generated in the Source column. A token with no description is listed as "Generated by Docker Desktop for CLI usage".
You can have up to five auto-generated tokens on your account. When Docker Desktop creates another one, the least recently used auto-generated token is deleted. A token that has never been used is ranked by when it was created. Tokens you create yourself are not deleted.
You can deactivate or delete an auto-generated token the same way as any other token.
Fair use policy
When using PATs, be aware that excessive token creation may result in throttling or additional charges. Docker reserves the right to impose restrictions on accounts with excessive PAT usage to ensure fair resource allocation and maintain service quality.
Best practices for fair use include:
- Reuse tokens across similar use cases instead of creating many single-purpose tokens
- Delete unused tokens regularly
- Use OATs for organization-wide automation
- Monitor token usage to identify optimization opportunities