Registry References and Authentication

Biosimulant Hub is the default registry. Unqualified references resolve there:

acme/cell-study@1.0.0

Custom registries use a qualified reference:

registry.example.com/acme/cell-study@1.0.0

Versions

Versions are immutable. Pull may omit a version to resolve the registry’s current default:

biosimulant labs pull acme/cell-study

For reproducible work, pin it:

biosimulant labs pull acme/cell-study@1.0.0

Publishing requires explicit package and version metadata.

Login

Authenticate to Hub:

biosimulant auth login

Authenticate to a custom registry without putting a secret in process arguments:

printf '%s\n' "$TOKEN" | \
  biosimulant auth login registry.example.com --token-stdin

Inspect or remove one registry credential:

biosimulant auth status registry.example.com
biosimulant auth logout registry.example.com

Credential precedence

For each operation, the CLI checks:

1. BIOSIMULANT_TOKEN
2. workspace-scoped token exchange
3. configured credential helper
4. OS keychain
5. owner-only credentials file

The fallback file is ~/.config/biosimulant/credentials.json and uses mode 0600 on Unix.

Never place credentials in artifact references, command history, lab files, or logs.

Studio workspaces

Studio injects a workspace-bound identity token. The CLI exchanges it only when a private pull or publish begins and receives a short-lived operation token. Long-lived user credentials do not enter the workspace.

Developer principals used for registry automation require packages:read and/or packages:write.

For HTTP endpoints and wire-level behavior, see the Registry API v1 protocol reference.