> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/artifact-registry/use-artifact-registry/manage-registries/client-setup.md).

# Client setup

{% hint style="info" %}
**CREATE A REGISTRY**

If you have not created a registry, go to [Create an artifact registry](/artifact-registry/use-artifact-registry/manage-registries/create-registry.md) to create one.
{% endhint %}

Client Setup simplifies authentication and ensures proper configuration for different artifact types (e.g., container images, Helm charts). It also helps prevent common misconfigurations when pulling or pushing artifacts.

### Client setup <a href="#client-setup" id="client-setup"></a>

1. On the **Registries** tab, select a registry of type `ARTIFACT REGISTRY`, such as Docker or Maven.
2. Select **Set up client**.
3. Follow the on-screen instructions.

#### Configuration steps <a href="#configuration-steps" id="configuration-steps"></a>

The Client Setup process provides step-by-step guidance, including:

* Logging in to the registry.
* Generating a password token.
* Pulling an image or package.
* Pushing an image or package.

The artifact appears in your Docker registry and on the **Artifacts** tab.

***

### Authentication model <a href="#authentication-model" id="authentication-model"></a>

Harness Artifact Registry uses token-based authentication (PAT or service account tokens). The pipeline identity model determines which permissions apply:

* **Manual triggers:** The pipeline uses the triggering user's RBAC permissions.
* **Webhook, IDP (Internal Developer Portal), or schedule triggers:** The pipeline runs as a service/bot principal and uses that bot's RBAC permissions.

This applies to both image pulls (requires read access) and the **Upload Artifacts to HAR** CI step (requires write access). If the triggering principal lacks the appropriate permission, the operation returns a 403 error.

{% hint style="info" %}
**SUPPORTED AUTHENTICATION METHODS**

Harness Artifact Registry supports PAT (Personal Access Token) and service account tokens for authentication. These work across all deployment environments including EKS, GKE, and AKS.
{% endhint %}

***

### Token expiry and management <a href="#token-expiry-and-management" id="token-expiry-and-management"></a>

Tokens generated from the **Setup Client** page are scoped tokens with a **30-day expiry**. For longer-lived tokens, generate them at the project or account level from your account settings.

* **Independent expiry:** Each token expires based on its own creation time. Generating a new token has no effect on existing tokens.
* **Secure by design:** The token value is shown only once at creation time. Copy and store it securely before closing the dialog.
* **Manage tokens:** Go to [Add and manage API keys](/harness-ai/use-harness-platform/automation/api/add-and-manage-api-keys.md) to view token names, check expiration dates, or delete tokens. You can also access this from **Profile Overview** (bottom-left icon in the Harness UI).

***

### Troubleshooting <a href="#troubleshooting" id="troubleshooting"></a>