Authenticate with the Chainguard API or an SDK

chainctl is the recommended way to authenticate. Use the OIDC/STS exchange described here only for the edge case where running chainctl is not an option (for example, a custom service or runtime that cannot invoke the binary).

Endpoint and parameters

POST (or GET with query params) to https://issuer.enforce.dev/sts/exchange. Pass the upstream OIDC token as the Authorization: Bearer header; pass aud and identity as form fields or query params.

curl -H "Authorization: Bearer $OIDC_TOKEN" \
  -d "aud=cgr.dev" \
  -d "identity=$ASSUMABLE_IDENTITY_ID" \
  "https://issuer.enforce.dev/sts/exchange"

Audience values

docker login username

For a short-lived STS/access token the username is _token (the token is the password):

chainctl auth token --audience cgr.dev | docker login -u _token --password-stdin cgr.dev

A pull token is different: its username is the pull token's identity ID. See "Automating pull token rotation".