Nvcr.io - 401 Authorization required

[pieterc]

Good morning - I am to authenticate to nvcr.io , but get a 401 Unauthorized error – following these steps:

* Pull and run NIM:

#export NGC_API_KEY=nvapi-***

#export LOCAL_NIM_CACHE=~/.cache/nim

#mkdir -p “$LOCAL_NIM_CACHE”

docker run -it --rm \

--gpus all \

--shm-size=16GB \

-e NGC_API_KEY \

-v “$LOCAL_NIM_CACHE:/opt/nim/.cache” \

-p 8000:8000 \

nvcr.io/nim/qwen/qwen3-next-80b-a3b-thinking:latest

// try to login to docker:

docker login nvcr.io --username “$oauthtoken” --password "***”

$ docker login nvcr.io

Username: $oauthtoken

Password: *******

root@cti-l4t:~# docker login nvcr.io --username “bravesirrobin253” --password ”****”

WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Error response from daemon: Get “``https://nvcr.io/v2/”:`` unauthorized:

[pieterc]

Some more details - HelloWorld works with Docker —

root@cti-l4t:/etc# sudo systemctl status docker
● docker.service - Docker Application Container Engine
Loaded: loaded (/lib/systemd/system/docker.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2025-09-29 15:17:28 SAST; 19h ago
TriggeredBy: ● docker.socket
Docs: https://docs.docker.com
Main PID: 20390 (dockerd)
Tasks: 12
Memory: 31.7M
CPU: 5.768s
CGroup: /system.slice/docker.service
└─20390 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock

Sep 29 15:17:28 cti-l4t dockerd[20390]: time=“2025-09-29T15:17:28.648763592+02:00” level=info msg=“Completed buildkit initialization”
Sep 29 15:17:28 cti-l4t dockerd[20390]: time=“2025-09-29T15:17:28.655580862+02:00” level=info msg=“Daemon has completed initialization”
Sep 29 15:17:28 cti-l4t dockerd[20390]: time=“2025-09-29T15:17:28.655670964+02:00” level=info msg=“API listen on /run/docker.sock”
Sep 29 15:17:28 cti-l4t systemd[1]: Started Docker Application Container Engine.
Sep 30 08:54:01 cti-l4t dockerd[20390]: time=“2025-09-30T08:54:01.094821944+02:00” level=error msg=“Not continuing with pull after error” error="unauthorized: \r\n401 Authorization Required\r\n
Sep 30 09:02:40 cti-l4t dockerd[20390]: time=“2025-09-30T09:02:40.515344493+02:00” level=error msg=“Not continuing with pull after error” error="unauthorized: \r\n401 Authorization Required\r\n
Sep 30 09:04:33 cti-l4t dockerd[20390]: time=“2025-09-30T09:04:33.803479992+02:00” level=error msg=“Not continuing with pull after error” error="unauthorized: \r\n401 Authorization Required\r\n
Sep 30 09:05:20 cti-l4t dockerd[20390]: time=“2025-09-30T09:05:20.440775609+02:00” level=error msg=“Not continuing with pull after error” error="unauthorized: \r\n401 Authorization Required\r\n
Sep 30 10:36:49 cti-l4t dockerd[20390]: time=“2025-09-30T10:36:49.948966763+02:00” level=error msg=“Not continuing with pull after error” error="unauthorized: \r\n401 Authorization Required\r\n
Sep 30 10:39:07 cti-l4t dockerd[20390]: time=“2025-09-30T10:39:07.135290569+02:00” level=error msg=“Not continuing with pull after error” error="unauthorized: \r\n401 Authorization Required\r\n
root@cti-l4t:/etc# sudo docker run hello-world
Unable to find image ‘hello-world:latest’ locally
latest: Pulling from library/hello-world
198f93fd5094: Pull complete
Digest: sha256:54e66cc1dd1fcb1c3c58bd8017914dbed8701e2d8c74d9262e26bd9cc1642d31
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:

1. The Docker client contacted the Docker daemon.
2. The Docker daemon pulled the “hello-world” image from the Docker Hub.
   (arm64v8)
3. The Docker daemon created a new container from that image which runs the
   executable that produces the output you are currently reading.
4. The Docker daemon streamed that output to the Docker client, which sent it
   to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
$ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:

Docker Hub Container Image Library | App Containerization

For more examples and ideas, visit:

Get started

root@cti-l4t:/etc#
root@cti-l4t:/etc#
root@cti-l4t:/etc# docker login nvcr.io
Username: bravesirrobin253
Password:
Error response from daemon: Get “https://nvcr.io/v2/”: unauthorized:

[pieterc]

Navigating to the URL in a browser gives : 401 Authorization Required. How to you authenticate ?

---

nginx/1.22.1 - oh

[sophwats]

Hi @pieterc,

Happy to help here. Firstly, you pasted your full NGC_API_KEY in the first piece of code you shared. I have removed it from the post, but please delete that key now by visiting this link: Try NVIDIA NIM APIs to prevent others from using it.

The issue seems to be that you are running an additional docker login command which overrides the correct login:

 $ docker login nvcr.io

 Username: $oauthtoken

 Password: \*\*\*\*\*\*\*

 root@cti-l4t:\~# docker login nvcr.io --username “bravesirrobin253” --password ”\*\*\*\*”

Please follow the instructions on this page qwen3-next-80b-a3b-thinking Model by Qwen | NVIDIA NIM to deploy the NIM succesfully - note that this runs ONE docker login command, using username $oauthtoken.

Let us know how you get on!

Best,

Sophie

[pieterc]

thx - killed that key – will try the steps below - thx

[pieterc]

Okay - think we are getting closer —> Some errors though:

bash: /development/deepseek1/ngc-cli/ngc: cannot execute binary file: Exec format error
root@cti-l4t:/development/deepseek1# which ngc | xargs rm

[pieterc]

yeah think I am missing trivial here –> root@cti-l4t:/development/deepseek1# export $oauthtoken=bravesirrobin253
bash: export: `=bravesirrobin253’: not a valid identifier
root@cti-l4t:/development/deepseek1# export oauthtoken=bravesirrobin253
root@cti-l4t:/development/deepseek1# docker login nvcr.io
Username: $oauthtoken
Password:
Error response from daemon: Get “https://nvcr.io/v2/”: unauthorized:
root@cti-l4t:/development/deepseek1# docker login nvcr.io
Username: $oauthtoken
Password:
Error response from daemon: Get “https://nvcr.io/v2/”: unauthorized:
root@cti-l4t:/development/deepseek1# echo $oauthtoken
bravesirrobin253

[pieterc]

getting there –> Enter API key [****xzWy]. Choices: [<VALID_APIKEY>, ‘no-apikey’]: xxxx
Enter CLI output format type [ascii]. Choices: [‘ascii’, ‘csv’, ‘json’]: ascii
Enter team [no-team]. Choices: [‘no-team’]: no-team
Enter ace [no-ace]. Choices: [‘no-ace’]: no-ace
Validating configuration…
Successfully validated configuration.
Saving configuration…
Successfully saved NGC configuration to /root/.ngc/config

[pieterc]

Hurray ! Winner !

root@cti-l4t:~# docker login nvcr.io
Username: $oauthtoken
Password:

WARNING! Your credentials are stored unencrypted in ‘/root/.docker/config.json’.
Configure a credential helper to remove this warning. See

docker login

Login Succeeded

[sophwats]

Great - looks like you’ve been able to login to docker with the correct username ($oauthtoken). Please let us know that you are able to run the docker container without seeing the 401 error.

Sophie

[pieterc]

yeah baby !

[pieterc]

okie dokie artichokey

[sophwats]

Looking successful so far. Sorry it was such a headache to get to this point!

S

[pieterc]

its al part of the learning curve ! having fun though :)

[pieterc]

oh no - not the space issue again :(

[pieterc]

docker: failed to register layer: write /usr/local/lib/python3.12/dist-packages/nvidia/nccl/lib/libnccl.so.2: no space left on device

Run ‘docker run --help’ for more information
root@cti-l4t:~# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mmcblk0p1 54G 32G 20G 63% /
tmpfs 15G 208K 15G 1% /dev/shm
tmpfs 6.0G 36M 6.0G 1% /run
tmpfs 5.0M 4.0K 5.0M 1% /run/lock
/dev/mmcblk0p10 63M 118K 63M 1% /boot/efi
tmpfs 3.0G 120K 3.0G 1% /run/user/1000
tmpfs 3.0G 1.7M 3.0G 1% /run/user/0

[pieterc]

trying to USB media and telling docker to download there … let’s see …

[pieterc]

Okay - updated my daemon.json config file to this :

{
“runtimes”: {
“nvidia”: {
“args”:[],
“path”: “nvidia-container-runtime”,
“data-root”: “/media/root/STORAGE”}}}

// Where “STORAGE” is my USB media

// Sorry for the bad indentation - but it is properly indented in the *.json file :)

So far so good — lets hope it completes successfully!

[pieterc]

Nope — fail

docker: failed to register layer: write /usr/local/lib/python3.12/dist-packages/nvidia/nvjitlink/lib/libnvJitLink.so.12: no space left on device

Run ‘docker run --help’ for more information
root@cti-l4t:/media/root/STORAGE# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mmcblk0p1 54G 32G 20G 62% /
tmpfs 15G 208K 15G 1% /dev/shm
tmpfs 6.0G 84M 6.0G 2% /run
tmpfs 5.0M 4.0K 5.0M 1% /run/lock
/dev/mmcblk0p10 63M 118K 63M 1% /boot/efi
tmpfs 3.0G 128K 3.0G 1% /run/user/1000
tmpfs 3.0G 1.7M 3.0G 1% /run/user/0
/dev/nvme0n1 916G 48K 870G 1% /media/root/STORAGE

[pieterc]

Looks like on my own on this one - anyway sharing is caring — Moving Docker’s storage location. The right way to move Docker’s default… | by Oliver Mascarenhas | Code Uncomplicated | Medium