---
title: "Registry Auth"
method: GET
path: "/registry/auth"
tags: ["Authentication"]
---

# Registry Auth

`GET /registry/auth`

Authenticate registry/docker pull requests.

In the Depot proxy flow this endpoint is called by nginx auth_request to
verify the miner before nginx proxies to Depot's token endpoint; it only
needs to return 200 on success (or 401 on failure).

The VM's attested measurement version decides which auth is required:

- version >= registry_mtls_min_version: mTLS.  The nginx frontend forwards the
  client cert as X-Client-Cert; the leaf is verified against the CA registered
  for the VM.  No legacy fallback — a VM this new must use mTLS.
- otherwise (older VM, or unknown IP): legacy Bittensor hotkey/signature/nonce.

Setting registry_mtls_min_version to "0.0.0" forces every attested VM onto
mTLS — the kill switch that closes the legacy "any registered miner can pull
any private chute" hole once the fleet is fully migrated.

The require_registry_proxy_secret dependency, when REGISTRY_PROXY_SECRET is configured,
rejects requests that do not carry X-Registry-Proxy-Auth matching the secret,
preventing X-Client-Cert / X-Real-IP spoofing on connections that bypass the
registry proxy.  The mTLS client cert is extracted (typed) by extract_optional_client_cert.

## Response `200`

Successful Response

- unknown

## Changes

- **2026-08-26** `8d909638091e` — 1 info
  - endpoint added
- **2026-08-22** `05d9af05d87e` — 1 breaking
  - api path removed without deprecation
- **2026-08-04** `352418d4e3a2` — 4 warning, 2 info
  - deleted the `header` request parameter `Authorization`
  - deleted the `header` request parameter `X-Chutes-Hotkey`
  - deleted the `header` request parameter `X-Chutes-Nonce`
  - deleted the `header` request parameter `X-Chutes-Signature`
  - …2 more

[Change history](https://skmtc.dev/chutes/apis/fastapi/changes/registry/auth/get.md)

---

[API](https://skmtc.dev/chutes/apis/fastapi.md) · [All operations](https://skmtc.dev/chutes/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/chutes/fastapi/revisions/7be1aa2fe1a0/schema)