KeyKeeperDocker Hub · Personal access token
How an agent gets a Docker Hub · Personal access token key through KeyKeeper, what to choose on app.docker.com, and how KeyKeeper verifies it.
| Template id | dockerhub (also docker) |
|---|---|
| Field | docker-token → DOCKER_TOKEN · secret |
| Also | docker-username → DOCKER_USERNAME · plain, confirmed by you |
| Key looks like | starts with dckr_pat_, shown once when created |
| Created at | app.docker.com |
| Verified by KeyKeeper | not verified |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show dockerhub
keykeeper save --provider dockerhub --from-clipboard --create --purpose "what this task does"
keykeeper run -c dockerhub -- <your command>--provider dockerhub fills in the credential id and the fields. The environment
variables are the ones Docker Hub's own tools read, so nothing has to be mapped.
What only you can do
What to choose
This item is a personal access token. Grant only Read or Write as needed and use docker login --password-stdin; Docker CLI does not automatically consume a generic token environment variable.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a Docker Hub · Personal access token key (starts with
dckr_pat_, shown once when created). A wrong paste is refused before anything is stored, and the agent is told why — without the value. - After saving: Docker Hub · Personal access token offers no read-only endpoint KeyKeeper can use, so the first real call is the test.
Rotation and expiry
No universal expiry policy was confirmed for this credential type. Record the date shown by the provider, or leave it unknown. Rotate or revoke at app.docker.com.