Managing access tokens
Estimated reading time: 3 minutes
Docker Hub lets you create personal access tokens as alternatives to your password. You can use tokens to access Hub images from the Docker CLI.
Using personal access tokens provides some advantages over a password:
- You can investigate the last usage of the access token and disable or delete it if you find any suspicious activity.
- When using an access token, you can’t perform any admin activity on the account, including changing the password. It protects your account if your computer is compromised.
Treat access tokens like your password and keep them secret. Store your tokens securely (for example, in a credential manager).
Access tokens are valuable for building integrations, as you can issue multiple tokens – one for each integration – and revoke them at any time.
If you have two-factor authentication (2FA) enabled on your account, you must create at least one personal access token. Otherwise, you will be unable to log in to your account from the Docker CLI.
Create an access token
You can create as many tokens as you need.
Log in to hub.docker.com.
Click on your username in the top right corner and select Account Settings.
Select Security > New Access Token.
Add a description for your token. Use something that indicates where the token will be used, or set a purpose for the token. You can view the following access permissions from the drop-down:
The table below lists the tokens available in each subscription:
Feature Personal Pro Team Business Personal Access Tokens (read, write, delete scope only)* x x x x Scoped Personal Access Tokens x x x Unlimited Personal Access Tokens x x
*You can create 1 access token as part of the Docker Personal tier, 5 tokens as part of Docker Pro, and Unlimited tokens as part of Docker Team and Business tier. For more information, see Docker Pricing.
Copy the token that appears on the screen and save it. You will not be able to retrieve the token once you close this prompt.
Use an access token
You can use an access token anywhere that requires your Docker Hub password.
When logging in from your Docker CLI client (
docker login --username <username>),
omit the password in the login command. Instead, enter your token when asked for
If you have two-factor authentication (2FA) enabled, you must use a personal access token when logging in from the Docker CLI. 2FA is an optional, but more secure method of authentication.
Modify existing tokens
You can rename, activate, deactivate, or delete a token as needed.
Access your tokens under Account Settings > Security. This page shows an overview of all your tokens. You can also view the number of tokens that are activated and deactivated in the toolbar.
Select a token and click Delete or Edit, or use the menu on the far right of a token row to bring up the edit screen. You can also select multiple tokens to delete at once.
After modifying the token, click the Save button to save your changes.
docker hub, hub, security, PAT, personal access token
Tip: Docker Hub CLI and API
Docker provides a Docker Hub CLI tool (currently experimental) and an API that allows you to interact with Docker Hub. Browse through the Docker Hub API documentation to explore the supported endpoints.