---
title: "Registry Auth"
method: GET
path: "/registry/auth"
tags: ["Authentication"]
---

# Registry Auth

`GET /registry/auth`

Authenticate registry/docker pull requests.

In the Depot proxy flow this endpoint is called by nginx auth_request to
verify the miner before nginx proxies to Depot's token endpoint; it only
needs to return 200 on success (or 401 on failure).

The VM's attested measurement version decides which auth is required:

- version >= registry_mtls_min_version: mTLS.  The nginx frontend forwards the
  client cert as X-Client-Cert; the leaf is verified against the CA registered
  for the VM.  No legacy fallback — a VM this new must use mTLS.
- otherwise (older VM, or unknown IP): legacy Bittensor hotkey/signature/nonce.

Setting registry_mtls_min_version to "0.0.0" forces every attested VM onto
mTLS — the kill switch that closes the legacy "any registered miner can pull
any private chute" hole once the fleet is fully migrated.

The require_registry_proxy_secret dependency, when REGISTRY_PROXY_SECRET is configured,
rejects requests that do not carry X-Registry-Proxy-Auth matching the secret,
preventing X-Client-Cert / X-Real-IP spoofing on connections that bypass the
registry proxy.  The mTLS client cert is extracted (typed) by extract_optional_client_cert.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.net/chutes/apis/fastapi.md) · [All operations](https://skmtc.net/chutes/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/chutes/fastapi/revisions/352418d4e3a2/schema)