---
title: "Create an access token"
description: "Create a Container Registry access token that Docker, Kubernetes, or a build system logs in with to pull images, or to pull and push them."
content_type: "how-to"
product: "container-registry"
platform: "MyAccount"
url: "/myaccount/container-registry/how-to/create-an-access-token/"
topic: ["create-and-connect"]
relationships: {"requires":["/myaccount/container-registry/how-to/create-a-registry-project/"]}
---

# Create an access token

An access token is what Docker logs in to your registry project with: its name is the username and
its value is the password. Give each machine or system that logs in its own token, so you can change
or remove one without affecting the others. A registry project holds up to five access tokens.

## Before you begin

You need a registry project that reads **Created** and, if you are a team member, a role with the
create permission for Container Registry. See [Create a registry
project](/myaccount/container-registry/how-to/create-a-registry-project/).

## Open the token form

1. In MyAccount, under **Storage**, click **Container Registry**, and click your project. Its tabs
   open.
2. On the **Access token** tab, headed **Manage Access Tokens**, click **+** (**Create New Token**).
   **Create Access Token** opens.

## Name the token

In **Name**, enter a name that says where the token is used, such as `build-server` or `k8s-prod`. A
token name:

- starts with a lowercase letter and is at least 2 characters long
- uses lowercase letters, numbers, dots, underscores, and hyphens
- has a dot, underscore, or hyphen only between other characters, never two together

Choose a name that is not already in use. The name is fixed once the token is created.

## Choose when it expires

Under **Expiration**, choose one:

- **Set number of days**: the token expires after the **Number of days** you enter, from 1 to 5000.
  The field starts at 1000, and the form shows **Token will expire on <date>**. Choose this for most
  tokens, so a token you forget about stops working on its own.
- **Never expires**: the token works until you disable or delete it. Choose this for a token you
  give a new value yourself, from time to time, with **Reset**.

Once a token shows **expired**, delete it and create a new one.

## Choose its permissions

Under **Permissions:**, **Pull** is always checked. Check **Push** as well for a token that pushes
images, such as the one your build system uses. Leave **Push** clear for anything that only runs
images, such as a node or a Kubernetes cluster.

A token pulls and pushes only. To delete repositories and artifacts, use MyAccount; see
[Delete a project, repository, or artifact](/myaccount/container-registry/how-to/delete-a-project-repository-or-artifact/).

## (Optional) Describe the token

In **Description**, add a note about what the token is for. It is shown in the token list.

## Create it and copy the value

Click **Create**. The **Access Token** dialog shows the **Token Name** and the **Token Value**. The
**Token Name** is `e2e` followed by your project's name, `+`, and your token name: for `cr-12345`
and `build-server`, it is `e2ecr-12345+build-server`. Copy both now and keep them somewhere safe.
The value is shown only this once, because E2E does not keep it. If you lose the value, reset the
token to get a new one; see [Manage an access
token](/myaccount/container-registry/how-to/manage-an-access-token/).

## Log in with the token

On the project's **Repositories** tab, click **Push Commands**, and copy the **Docker Login
Command**. The command already holds the registry address, `registry.e2enetworks.net`. Replace the
token name placeholder with the **Token Name** and the token value placeholder with the **Token
Value**, and run it:

```bash
docker login registry.e2enetworks.net -u <token_name> -p <token_value>
```

Docker prints `Login Succeeded`. For logging in from a script or CI job, see
[Push and pull images](/myaccount/container-registry/how-to/push-and-pull-images/#log-in). If it
returns unauthorized instead, see
[Troubleshooting Container Registry](/myaccount/container-registry/troubleshooting/container-registry/#docker-login-returns-unauthorized).

The token is listed on the **Access token** tab with its **Name**, **Status**, **Description**,
**Permissions**, and **Expires At**. You can now pull images, and push them if you checked **Push**;
see [Push and pull images](/myaccount/container-registry/how-to/push-and-pull-images/).