Chapter 15. Using the Red Hat Quay API

Procedure

1. On the main page, select an Organization.
2. In the navigation pane, select Applications.
3. Click Create New Application and provide a new application name, then press Enter.
4. On the OAuth Applications page, select the name of your application.

5. Optional. Enter the following information:

   1. Application Name
   2. Homepage URL
   3. Description
   4. Avatar E-mail
   5. Redirect/Callback URL prefix
6. In the navigation pane, select Generate Token.

7. Check the boxes for the following options:

   1. Administer Organization
   2. Administer Repositories
   3. Create Repositories
   4. View all visible repositories
   5. Read/Write to any accessible repositories
   6. Super User Access
   7. Administer User
   8. Read User Information
8. Click Generate Access Token. You are redirected to a new page.
9. Review the permissions that you are allowing, then click Authorize Application. Confirm your decision by clicking Authorize Application.

10. You are redirected to the Access Token page. Copy and save the access token.

    Important

    This is the only opportunity to copy and save the access token. It cannot be reobtained after leaving this page.

Procedure

1. Update your config.yaml file to include the FEATURE_REFERRERS_API: true field. For example:

   # ...
   FEATURE_REFERRERS_API: true
   # ...

2. Enter the following command to Base64 encode your credentials:

   $ echo -n '<username>:<password>' | base64

   Example output

   abcdeWFkbWluOjE5ODlraWROZXQxIQ==

3. Enter the following command to use the base64 encoded string and modify the URL endpoint to your Red Hat Quay server:

   $ curl --location '<quay-server.example.com>/v2/auth?service=<quay-server.example.com>&scope=repository:quay/listocireferrs:pull,push' --header 'Authorization: Basic <base64_username:password_encode_token>' -k | jq

   Example output

   {
     "token": "<example_secret>
   }

Procedure

1. Optional. If not already, update your Red Hat Quay config.yaml file to include the FEATURE_ASSIGN_OAUTH_TOKEN: true field:

   # ...
   FEATURE_ASSIGN_OAUTH_TOKEN: true
   # ...

2. Optional. Restart your Red Hat Quay registry.
3. Log in to your Red Hat Quay registry as an organization administrator.
4. Click the name of the organization in which you created the OAuth token for.
5. In the navigation pane, click Applications.
6. Click the proper application name.
7. In the navigation pane, click Generate Token.
8. Click Assign another user and enter the name of the user that will take over the OAuth token.

9. Check the boxes for the desired permissions that you want the new user to have. For example, if you only want the new user to be able to create repositories, click Create Repositories.

   Important

   Permission control is defined by the team role within an organization and must be configured regardless of the options selected here. For example, the user that you are assigning the OAuth token to must have the Admin team role to use administrative API endpoints.

   Solely checking the Super User Access box does not actually grant the user this permission. Superusers must be configured via the config.yaml file and the box must be checked here.

10. Click Assign token. A popup box appears that confirms authorization with the following message and shows you the approved permissions:

    This will prompt user <username> to generate a token with the following permissions:
    repo:create

11. Click Assign token in the popup box. You are redirected to a new page that displays the following message:

    Token assigned successfully

Verification

1. After reassigning an OAuth token, the assigned user must accept the token to receive the bearer token, which is required to use API endpoints. Request that the assigned user logs into the Red Hat Quay registry.
2. After they have logged in, they must click their username under Users and Organizations.
3. In the navigation pane, they must click External Logins And Applications.
4. Under Authorized Applications, they must confirm the application by clicking Authorize Application. They are directed to a new page where they must reconfirm by clicking Authorize Application.
5. They are redirected to a new page that reveals their bearer token. They must save this bearer token, as it cannot be viewed again.