Chapter 4. OCI referrers OAuth access token
In some cases, depending on the features that your Red Hat Quay deployment is configured to use, you might need to leverage an OCI referrers OAuth access token. OCI referrers OAuth access tokens are used to list OCI referrers of a manifest under a repository, and uses a curl command to make a GET request to the Red Hat Quay v2/auth endpoint.
These tokens are obtained via basic HTTP authentication, wherein the user provides a username and password encoded in Base64 to authenticate directly with the v2/auth API endpoint. As such, they are based directly on the user’s credentials aod do not follow the same detailed authorization flow as OAuth 2, but still allow a user to authorize API requests.
OCI referrers OAuth access tokens do not offer scope-based permissions and do not expire. They are solely used to list OCI referrers of a manifest under a repository.
Additional resource
4.1. Creating an OCI referrers OAuth access token
This OCI referrers OAuth access token is used to list OCI referrers of a manifest under a repository.
Procedure
Update your
config.yamlfile to include theFEATURE_REFERRERS_API: truefield. For example:# ... FEATURE_REFERRERS_API: true # ...
Enter the following command to Base64 encode your credentials:
$ echo -n '<username>:<password>' | base64
Example output
abcdeWFkbWluOjE5ODlraWROZXQxIQ==
Enter the following command to use the base64 encoded string and modify the URL endpoint to your Red Hat Quay server:
$ curl --location '<quay-server.example.com>/v2/auth?service=<quay-server.example.com>&scope=repository:quay/listocireferrs:pull,push' --header 'Authorization: Basic <base64_username:password_encode_token>' -k | jq
Example output
{ "token": "<example_secret> }
