---
title: Registry credentials
description: Store a username and token for a private container registry so Dekka can pull your private images.
section: Account
order: 5
---

A registry credential is a username and password or token that Dekka uses to pull [private images](/docs/docker-images#deploy-a-private-image) from one registry, such as GitHub Container Registry. Credentials belong to the organisation, so any project in it can use them.

## Add a credential

Open **Settings**, then **Registries**, choose **Add credential**, and fill in a **Name**, the **Registry** host, your **Username** and a **Token or password**. Enter the host only, such as `ghcr.io`, `docker.io` or `registry.gitlab.com`. Use an access token with read-only access to packages where your registry offers one.

```bash tab="cURL"
curl https://api.dekka.cloud/v1/orgs/$ORG_ID/registry-credentials \
  -H "Authorization: Bearer $DEKKA_API_KEY" \
  --json '{ "name": "GitHub packages", "registry": "ghcr.io", "username": "acme-bot", "password": "ghp_…" }'
```

Dekka encrypts the token and never shows it again. The list shows the last four characters so you can tell credentials apart, and the response's `id` is what a service's `registry_credential_id` takes.

## Delete a credential

Delete it from the **Registries** page. While any service's image source still names it, Dekka refuses with 409 `registry_credential_in_use`, so point those services at another credential first.