# Registry References and Authentication Biosimulant Hub is the default registry. Unqualified references resolve there: ```text acme/cell-study@1.0.0 ``` Custom registries use a qualified reference: ```text registry.example.com/acme/cell-study@1.0.0 ``` ## Versions Versions are immutable. Pull may omit a version to resolve the registry's current default: ```bash biosimulant labs pull acme/cell-study ``` For reproducible work, pin it: ```bash biosimulant labs pull acme/cell-study@1.0.0 ``` Publishing requires explicit package and version metadata. ## Login Authenticate to Hub: ```bash biosimulant auth login ``` Authenticate to a custom registry without putting a secret in process arguments: ```bash printf '%s\n' "$TOKEN" | \ biosimulant auth login registry.example.com --token-stdin ``` Inspect or remove one registry credential: ```bash biosimulant auth status registry.example.com biosimulant auth logout registry.example.com ``` ## Credential precedence For each operation, the CLI checks: 1. `BIOSIMULANT_TOKEN` 2. workspace-scoped token exchange 3. configured credential helper 4. OS keychain 5. owner-only credentials file The fallback file is `~/.config/biosimulant/credentials.json` and uses mode `0600` on Unix. Never place credentials in artifact references, command history, lab files, or logs. ## Studio workspaces Studio injects a workspace-bound identity token. The CLI exchanges it only when a private pull or publish begins and receives a short-lived operation token. Long-lived user credentials do not enter the workspace. Developer principals used for registry automation require `packages:read` and/or `packages:write`. For HTTP endpoints and wire-level behavior, see the [Registry API v1 protocol reference](/references/cli/registry-api).