--- name: Registry-ts_auth_req title: Resolving `authorization required` errors in Container Registry description: You are trying to access Container Registry but you get an `Authorization required` error. Use these steps to diagnose the issue, which is often caused by an expired API key or missing IAM permissions. last-updated: 2026-08-11 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/Registry?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Resolving `authorization required` errors in Container Registry {: #troubleshoot-auth-req} {: troubleshoot} {: support} You are trying to access Container Registry but you get an `Authorization required` error. Use these steps to diagnose the issue, which is often caused by an expired API key or missing IAM permissions. {: shortdesc} When you try to access Container Registry, you get one of the following messages. {: tsSymptoms} - `Authorization required. See https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-auth-req` - `You were not authorized to complete this operation.` - `CRG0014E An error occurred when authenticating your request with IBM Cloud. Clear your browser cookies, log in to IBM Cloud, and try your request again.` - `Status code 401 Unauthorized`, you might see this message if you are using IBM Cloud Code Engine, see [Why am I getting an `Unauthorized` error when I'm using Code Engine?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-unauthorized-ce&format=markdown) for assistance. - `UNAUTHORIZED: Authorization required`, you might see this message if you are using `cosign` with Podman, see [Why am I having problems when I try to pull an image with `cosign` when I'm using Podman?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-cosign-podman&format=markdown) for assistance. The following alternatives are possible causes: {: tsCauses} **Scenario A.** You're trying to push or a pull an image, but you don't have a valid credential. - You attempted to log in to Container Registry with an invalid API key. - You attempted to access Container Registry without logging in. - A client attempted to access Container Registry without a bearer token. - A client attempted to access Container Registry with an expired OAuth token. For more information about how to fix this problem, see [Scenario A. You're trying to push or pull an image](#troubleshoot-auth-req-push-pull). **Scenario B.** You're logged in to the wrong region of Container Registry. To check which region you're logged in to, run the [`ibmcloud cr region`](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcli&format=markdown#bx_cr_region) command. For more information about how to fix this problem, see [Scenario B. You're logged in to the wrong region](#troubleshoot-auth-req-region). **Scenario C.** You're trying to use the API. - You attempted to authenticate against the Container Registry API with an invalid API key. - You attempted to authenticate against the Container Registry API with an invalid Account ID. For more information about how to fix this problem, see [Scenario C. You're trying to use the API](#troubleshoot-auth-req-api). You can fix this problem in the following ways: {: tsResolve} ## Scenario A. You're trying to push or pull an image {: #troubleshoot-auth-req-push-pull} You can't access Container Registry because you don't have a valid credential. You can fix these problems in the following ways: - Check the information about logging a client into Container Registry, see [Push images to your namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started&format=markdown#gs_registry_images_pushing). - Create and use a valid IAM API key to log a client, such as Docker, in to Container Registry with username `iamapikey` and the API key as your password. For more information, see [Managing user API keys](https://cloud.ibm.com/docs/iam?topic=iam-userapikey&interface=ui&format=markdown#userapikey). - When you access Container Registry by using automation, set up a service ID and API key. For more information, see [Accessing Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_access&format=markdown#registry_access_serviceid_apikey_create). ## Scenario B. You're logged in to the wrong region {: #troubleshoot-auth-req-region} You can't access Container Registry because you're logged in to the wrong region. To check which region you're logged in to, run the [`ibmcloud cr region`](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcli&format=markdown#bx_cr_region) command. You can fix this problem in the following way: If your image is in a different region of Container Registry, you must log in to IBM Cloud in the correct region by running the following commands. 1. `ibmcloud cr region-set REGION`, where `REGION` is the name of the region, see [Local regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview&format=markdown#registry_regions_local). 2. `ibmcloud cr login` For more information, see [Targeting a local region](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview&format=markdown#registry_regions_local_target). ## Scenario C. You're trying to use the API {: #troubleshoot-auth-req-api} You can't access Container Registry because you attempted to authenticate against the Container Registry API with an invalid API key or Account ID. You can fix this problem in the following ways: - Use the `ibmcloud` command-line interface (CLI) or IAM API to retrieve a valid OAuth token to authenticate against the Container Registry API. For more information, see [IBM Cloud Container Registry API - Authentication](https://cloud.ibm.com/apidocs/container-registry#authentication). - When you authenticate against the Container Registry API, ensure that you use a valid Account ID. You can retrieve your Account ID by running the [`ibmcloud account show`](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_account&format=markdown#ibmcloud_account_show) command.