---
title: "Registry token"
method: GET
path: "/api/registry/token"
tags: ["container"]
---

# Registry token

`GET /api/registry/token`

Mints a short-lived EdDSA JWT for the HuggingFace container registry, verifiable via the JWK at `/api/keys/jwt`.

## Query parameters

- `service` string, required — Registry service identifier — placed in the JWT `aud` claim.
- `scope` union — Docker Distribution scope(s), e.g. `repository:org/img:push,pull`. May be repeated.
  - string
  - string[]

## Response `200`

Docker Distribution v2 token response — see https://distribution.github.io/distribution/spec/auth/jwt/

- object
  - `token` string, required — EdDSA JWT signed by the moon JWT key, carrying `access[]`.
  - `access_token` string, required — Identical to `token` — Docker Distribution v2 accepts either field.
  - `expires_in` integer, required — JWT lifetime in seconds.
  - `issued_at` string, date-time, required — ISO-8601 timestamp at which the JWT was minted.

---

[API](https://skmtc.net/huggingface/apis/hub-api-endpoints.md) · [All operations](https://skmtc.net/huggingface/apis/hub-api-endpoints/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/huggingface/hub-api-endpoints/versions/dae0cc3790f0/schema)