---
title: "Store credentials for pulling private images from a registry."
method: POST
path: "/v1/images/registries"
tags: ["images"]
---

# Store credentials for pulling private images from a registry.

`POST /v1/images/registries`

## Request

- Base URL: `https://api.withruntime.com`
- URL: `https://api.withruntime.com/v1/images/registries`
- Auth: HTTP bearer

Replaces any credentials stored for the same registry. The secret is sealed to Runtime's hosts the moment it arrives: the API can never read it back and no call returns it. A build opens it only to pull, inside its own build guest. For Amazon ECR, give an access key that may call ecr:GetAuthorizationToken and pull; each build asks ECR for a fresh token.

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `registry` string, required: The registry host: docker.io, ghcr.io, gcr.io, us-docker.pkg.dev, 123456789012.dkr.ecr.us-east-1.amazonaws.com, or any other.
  - `username` string: Docker Hub or GitHub user, oauth2accesstoken or _json_key for Google.
  - `password` string: A token or password; for _json_key, the service account's JSON key.
  - `accessKeyId` string: Amazon ECR: an AWS access key id.
  - `secretAccessKey` string: Amazon ECR: its secret.

## Response `200`

Success

- object
  - `id` string, required
  - `registry` string, required
  - `kind` 'basic' | 'ecr', required
  - `username` string, required
  - `region` string, nullable
  - `createdAt` string

## Other responses

- `default`: Error

---

[API](https://skmtc.dev/withruntime/apis/runtime-cloud-api.md) · [All operations](https://skmtc.dev/withruntime/apis/runtime-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/withruntime/apis/runtime-cloud-api/revisions/6f4012286988?raw)