> **Note (2026-06-25):** Closed beta starts on **Cloud Connector v1** (same-boundary) per [ADR-020](https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/artifact_registry/decisions/020_authentication_flow/) revision 2. The **CC v2** framing throughout this epic predates that decision; for closed beta, `get-token` / `login` / `docker-credential-glab` target **CC v1**. The closed-beta CLI auth work is tracked in gitlab-org/ops/artifact-registry#222 under the AuthN epic &22504. This epic remains the reference for the background, PoC, and competitive analysis, and the home for the management commands (and the CC v2 / cross-boundary follow-up). --- ### Background AR runs outside the monolith as a standalone modular service. Existing GitLab credentials (PATs, deploy tokens, CI job tokens) cannot authenticate against it directly. Clients must exchange credentials for a CC v2 JWT via their GitLab instance first. See [#595150](https://gitlab.com/gitlab-org/gitlab/-/work_items/595150) for the full problem statement, competitive analysis, and CLI design proposal. A [PoC](https://gitlab.com/jdrpereira/cli/-/tree/feat/ar-auth) validated this flow end-to-end with a prototype `glab ar` command group: token exchange, per-tool login wrappers, and a Docker credential helper. Beyond authentication, AR's product direction focuses on fundamentals that age well: solid APIs, authentication and authorization, and programmatic interfaces. Developers and AI agents interact with registries from terminals and agentic tools. `glab` is the natural integration point for both audiences: a fully featured CLI for repository and artifact management. AR Closed Beta is planned for FY27-Q2. The AR team (Package group) can contribute these changes directly to the [`glab`](https://gitlab.com/gitlab-org/cli) repository. ### Scope Changes to [`glab`](https://gitlab.com/gitlab-org/cli) for AR. Two areas: 1. **Authentication**: token exchange (`glab ar get-token`, `glab ar login`, `docker-credential-glab`) as per the [PoC](https://gitlab.com/jdrpereira/cli/-/tree/feat/ar-auth) 2. **Management commands**: CRUD for repositories, artifacts, and settings via AR's API ### 1. Authentication Refine and upstream the PoC `glab ar` commands into the official CLI. - **`glab ar get-token`**: composable primitive. Exchanges a GitLab credential for a CC v2 JWT, outputs to stdout. Flags: `--hostname`, `--duration` (15m to 12h), `--scope`, `--format`. - **`glab ar login --docker/--maven/--npm/--gradle/--sbt`**: convenience wrappers that configure tool-specific credential files with a fresh JWT. All require `--registry`. - **`docker-credential-glab` CC v2 path**: extend the existing credential helper with a CC v2 code path for AR registries. Fresh JWT on every `get` call, making token expiry transparent for Docker/OCI clients. Industry precedent: `aws codeartifact login`, `gcloud auth configure-docker`, `az acr login`. ### 2. Management commands `glab ar` commands for managing AR resources, building on the management API. Target surface (indicative, to be refined with UX): - `glab ar repo list/create/delete/info` - `glab ar artifact list/delete/info` - ... ### Child issues Potential work breakdown (to be refined): | Issue | Scope | |---|---| | Auth: `glab ar get-token` and `glab ar login` | Upstream PoC auth commands | | Auth: `docker-credential-glab` CC v2 path | Extend credential helper for AR | | Management: repository commands | `repo list/create/delete/info` | | Management: artifact commands | `artifact list/delete/info` | ### References - [#595150](https://gitlab.com/gitlab-org/gitlab/-/work_items/595150): client credential management research, competitive analysis, CLI design - CC v2 PoC: [CLI](https://gitlab.com/jdrpereira/cli/-/tree/feat/ar-auth), [AR](https://gitlab.com/jdrpereira/artifact-registry-poc/-/tree/cc-v2-client-credentials), [Rails](https://gitlab.com/gitlab-org/gitlab/-/tree/jdrpereira/cc-v2-client-credentials)