Galleon authentication uses a password and a user token; the access model is described in Access control.

Password

The password is used to sign in to the web interface. It can be changed in the profile: the avatar menu → “Profile” → “Change password” (the current password is required). If the administrator has required a password change, all other actions in the web interface are blocked until it is completed.

User token

In command-line clients and CI, use the token instead of the password: it is supplied as a regular username/password pair, and if compromised, it can be revoked without changing the account password.

To generate a token, follow these steps:

  1. Open “Profile”, the “User token” section.
  2. Click “Generate”.
  3. Save the displayed values: use “Name code” as the username and “Pass code” as the password.

The pass code is shown only once — right after generation. If the value is lost, generate the token anew.

Each user can have one active token:

  • “Regenerate” issues a new token in place of the old one — the old credentials stop working immediately;
  • “Delete” revokes the token without issuing a new one.

Using the credentials in clients

The token (or the password) is supplied wherever a format client expects a username and password: in docker login, Maven settings.xml, .npmrc, ~/.pypirc, ~/.netrc, and others. Ready-made examples for every client are collected in the Formats section.

RubyGems (the ~/.gem/credentials file) and Cargo (the cargo login command) take the credentials as a ready authorization header string Basic <BASE64>, where <BASE64> is <USERNAME>:<PASSWORD> encoded in base64. See the RubyGems and Cargo pages for details.

If the client gets an error

A 401 answer means the credentials were not accepted: most often the token was regenerated with “Regenerate” or removed with “Delete”, and the old values stopped working. A 403 answer means a privilege for the operation is missing — ask your administrator for the rights. A 404 answer comes both for a missing artifact and for missing access rights (Access control), and for proxy repositories — from the negative cache as well (Proxying and caching).