Registry authentication

Use doomer login for the free public catalog. Auth attributes usage; it is not a paywall.

Catalog search and pull go through the Doomer CLI. Sign in with doomer login so we can attribute usage. There is no premium catalog tier. Some listings may remain experimental and need an access grant.

Private packages can live in your hosted project namespace and use this same login flow. Choose a project during browser login with --team. External OCI registries remain supported with their own credentials.

Interactive login

bash

doomer login
doomer whoami
doomer pull go/security
doomer run go/security --path .

Credentials are stored in the selected CLI profile (default default). Use doomer logout to clear them.

Headless and CI

bash

doomer login --device
doomer login --ci

Prefer short-lived --ci tokens or project service accounts for automation rather than long-lived personal credentials.

Service account tokens

Team owners and admins can create automation tokens from the Team page for CI catalog pulls and official publish workflows. Pipe the token into the CLI:

bash

export ADVERSARY_TOKEN="adv_sa_..."

printf '%s\n' "$ADVERSARY_TOKEN" | doomer login \
  --token-stdin --registry-namespace adversarylabs

doomer whoami
doomer pull go/security

api:readregistry:pullregistry:push