Using Repository Access Tokens to pull Docker Images from the Bitbucket packages registry externally

Marc_z6he7t

Hello,

I have a Bitbucket Pipeline in my repository that successfully builds a Docker image and pushes it to the Bitbucket Container Registry.

I can pull the image from my laptop using a Personal API Token with the read:package:bitbucket scope, so the registry itself is working correctly. However, I would prefer not to use my personal token for this use case.

To avoid that, I created a Repository Access Token. The available scopes only seem to include read:repository (I could not find any package/container registry related scope), but authentication always fails when I try to pull the image using this token.

I also tried authenticating with both:

x-token-auth

<repo-uuid>@bots.bitbucket.org

for docker login, based on what I read in here, but I still receive authorization errors.

Am I missing a required scope or configuration for pulling images from the Bitbucket Container Registry using Repository Access Tokens?

Thanks.

Ajay _view26_

Hi @Marc 

Repository Access Tokens don't currently support the container registry — that's the root cause here.

The Bitbucket Packages registry requires the read:package:bitbucket scope, which is only available on Atlassian API tokens (user-level tokens), not Repository Access Tokens. The repo-level tokens are scoped to repository operations only, so regardless of the username format you use (x-token-auth or the bot UUID), the auth will fail at the registry layer.