az acr token

Manage tokens for an Azure Container Registry.

Commands

az acr token create

Create a token associated with a scope map for an Azure Container Registry.

az acr token credential

Manage credentials of a token for an Azure Container Registry.

az acr token credential delete

Delete a token credential.

az acr token credential generate

Generate or replace one or both passwords of a token for an Azure Container Registry. For using token and password to access a container registry, see https://aka.ms/acr/repo-permissions.

az acr token delete

Delete a token for an Azure Container Registry.

az acr token list

List all tokens for an Azure Container Registry.

az acr token show

Show details and attributes of a token for an Azure Container Registry.

az acr token update

Update a token (replace associated scope map) for an Azure Container Registry.

az acr token create

Create a token associated with a scope map for an Azure Container Registry.

az acr token create --name
                    --registry
                    [--expiration]
                    [--expiration-in-days]
                    [--no-passwords {false, true}]
                    [--repository]
                    [--resource-group]
                    [--scope-map]
                    [--status {disabled, enabled}]
                    [--subscription]

Examples

Create a token with repository permissions defined in the scope map 'MyScopeMap'.

az acr token create -n MyToken -r MyRegistry --scope-map MyScopeMap

Create a token which has read permissions on hello-world repository.

az acr token create -n myToken -r MyRegistry --repository hello-world content/read metadata/read

Create a token without credentials.

az acr token create -n myToken -r MyRegistry --repository hello-world content/read --no-passwords

Create a token in disabled status.

az acr token create -n MyToken -r MyRegistry --scope-map MyScopeMap --status disabled

Required Parameters

--name -n

The name of the token.

--registry -r

The name of the container registry. You can configure the default registry name using az configure --defaults acr=<registry name>.

Optional Parameters

--expiration

UTC time for which the credentials will be valid. In the format of %Y-%m-%dT%H:%M:%SZ, e.g. 2025-12-31T12:59:59Z.

--expiration-in-days

Number of days for which the credentials will be valid. If not specified, the expiration will default to the max value "9999-12-31T23:59:59.999999+00:00".

--no-passwords

Do not generate passwords, instead use "az acr token credential generate".

accepted values: false, true
--repository

Repository permissions. Use the format "--repository REPO [ACTION1 ACTION2 ...]" per flag. Valid actions are {'content/delete', 'content/write', 'metadata/read', 'content/read', 'metadata/write'}.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--scope-map

The name of the scope map with pre-configured repository permissions. Use "--repository" if you would like CLI to configure one for you.

--status

The status of the token.

accepted values: disabled, enabled
default value: enabled
--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az acr token delete

Delete a token for an Azure Container Registry.

az acr token delete --name
                    --registry
                    [--resource-group]
                    [--subscription]
                    [--yes]

Examples

Delete the token 'MyToken'.

az acr token delete -n MyToken -r MyRegistry

Required Parameters

--name -n

The name of the token.

--registry -r

The name of the container registry. You can configure the default registry name using az configure --defaults acr=<registry name>.

Optional Parameters

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--yes -y

Do not prompt for confirmation.

az acr token list

List all tokens for an Azure Container Registry.

az acr token list --registry
                  [--query-examples]
                  [--resource-group]
                  [--subscription]

Examples

List tokens under the registry 'MyRegistry'.

az acr token list -r MyRegistry

Required Parameters

--registry -r

The name of the container registry. You can configure the default registry name using az configure --defaults acr=<registry name>.

Optional Parameters

--query-examples

Recommend JMESPath string for you. You can copy one of the query and paste it after --query parameter within double quotation marks to see the results. You can add one or more positional keywords so that we can give suggestions based on these key words.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az acr token show

Show details and attributes of a token for an Azure Container Registry.

az acr token show --name
                  --registry
                  [--query-examples]
                  [--resource-group]
                  [--subscription]

Examples

Get information for the token 'MyToken'.

az acr token show -n MyToken -r MyRegistry

Required Parameters

--name -n

The name of the token.

--registry -r

The name of the container registry. You can configure the default registry name using az configure --defaults acr=<registry name>.

Optional Parameters

--query-examples

Recommend JMESPath string for you. You can copy one of the query and paste it after --query parameter within double quotation marks to see the results. You can add one or more positional keywords so that we can give suggestions based on these key words.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az acr token update

Update a token (replace associated scope map) for an Azure Container Registry.

az acr token update --name
                    --registry
                    [--resource-group]
                    [--scope-map]
                    [--status {disabled, enabled}]
                    [--subscription]

Examples

Update the token 'MyToken', making it associated with the scope map 'MyNewScopeMap'.

az acr token update -n MyToken -r MyRegistry --scope-map MyNewScopeMap

Required Parameters

--name -n

The name of the token.

--registry -r

The name of the container registry. You can configure the default registry name using az configure --defaults acr=<registry name>.

Optional Parameters

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--scope-map

The name of the scope map associated with the token. If not specified, running this command will disassociate the current scope map related to the token.

--status

The status of the token.

accepted values: disabled, enabled
default value: enabled
--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.