If your container image is public, skip this page — Xano pulls it anonymously and nothing needs configuring.
For a private image, switch on the private image toggle in the Add Microservice panel. A compact Authentication method picker appears with three flows.
How credentials are handled
Whichever method you choose, the panel assembles a Kubernetes .dockerconfigjson in your browser and sends it once, on create, as part of the request.
From then on:
- The backend masks it. It is never returned to the UI.
- Only a sanitized descriptor comes back — the registry
server, the credential type, and an expiry timestamp where one applies — so the UI can show “credentials configured for this registry” without ever holding the secret.
- Xano provisions a microservice-owned pull secret named after the service, in the form
<identifier>-pull. For a microservice named echo-docker that is echo_docker-pull, and it appears in the Summary pane and in the generated XanoScript.
Because credentials are masked, they cannot be edited back out of the UI. To change them, re-enter them.
Authentication methods
Docker / v2
Google Artifact Registry
AWS ECR
Use for: Docker Hub, GHCR, GitLab, Quay, or any Docker v2 registry.Provide a username and a password or access token. Prefer an access token over an account password wherever the registry offers one.The registry host is derived from the image automatically — index.docker.io when the image has no host prefix. It stays editable, and auto-derivation stops as soon as you edit it by hand, so a later change to the image won’t overwrite a host you set deliberately.
Use for: Google Artifact Registry and the older Google Container Registry.Paste a service-account JSON key with read access to the repository. The panel encodes it as the _json_key user the registry expects.As with the Docker flow, the registry host is derived from the image (defaulting to us-docker.pkg.dev) and remains editable.Grant the service account the narrowest role that works — Artifact Registry Reader is enough to pull.
Use for: Amazon Elastic Container Registry.Paste the contents of your ~/.docker/config.json, as produced by aws ecr get-login-password piped into docker login. The panel keeps only the ECR entries — hosts containing ecr.aws or amazonaws.com — and discards everything else, so an unrelated Docker Hub login sitting in the same file is not sent to Xano.The registry host comes from the pasted file rather than being derived from the image, so the host field does not auto-sync for this method.ECR tokens are short-lived. An ECR login is valid for roughly 12 hours. Once it expires, Xano can no longer pull the image, and a redeploy or a pod restart will fail with an image-pull error. The panel surfaces this warning when you pick the method.For long-running services, plan on re-entering credentials, or use a registry with long-lived credentials.
Testing image access
Test image access probes the registry from the backend and reports the result inline, before you create anything. The same verdict appears as a chip in the Summary pane.
It works with or without credentials — an anonymous probe is exactly how you confirm a public image is reachable.
Running this before your first deploy turns the most common failure — a container stuck in ImagePullBackOff — into an answer you get in a second, rather than something you diagnose from pod status after a failed rollout.
Helm charts from private registries
Charts use the same credential flows and have their own probe. Test chart access returns the same five verdicts, worded for charts: Chart found & pullable, Chart or version not found, Couldn’t reach the chart registry, and so on. 
Xano