# Fix docker scout "unauthorized: authentication required" after session expiry

## TL;DR
docker scout authenticates through your Docker Hub session, and that session expired, so scout's requests are now anonymous and rejected. Log back in to Docker Hub from the CLI to refresh the session. scout picks up the fresh credentials and the scan runs.

```text
docker scout: "unauthorized: authentication required" after the docker desktop session expired
```

## Steps

1. Confirm the session is the problem by checking your current login state.
   - Run: docker info 2>&1 | grep -i username
   - Expected: no username shown, or an error, confirming you are logged out.

2. Log back in to Docker Hub from the CLI. Use your Docker Hub username and a personal access token when prompted.
   - Run: docker login
   - Expected: "Login Succeeded" printed at the end.

3. Re-run the scout scan that failed.
   - Run: docker scout cves [YOUR IMAGE]
   - Expected: scout authenticates and prints the CVE report instead of the unauthorized error.

4. If it still fails, clear the stale credential entry and log in fresh.
   - Run: docker logout, then docker login again
   - Expected: the second login succeeds and scout works, proving the old stored credential was the stale one.

## Use this when
- docker scout fails with "unauthorized: authentication required"
- scout worked before and broke after a Docker Desktop session expiry or password/token rotation
- A CI job uses a Docker Hub token that was rotated or revoked

## Not for this skill when
- docker scout cannot reach the network at all (check connectivity and proxy)
- The image itself does not exist or is private to another org (check the image reference and org access)
- docker login succeeds but scout still fails (check for an org-level SSO enforcement on the account)

## Variant phrasings
- docker scout unauthorized authentication required
- docker scout login expired
- docker scout cves auth error

## Why it happens
scout's vulnerability data and image analysis are served behind Docker Hub authentication, and the CLI reuses the session stored by docker login. Docker Desktop sessions expire (and tokens get rotated), after which the stored credential is rejected. scout does not proactively refresh it, so every call fails until you log in again.

## Edge cases
- SSO-enforced orgs: the personal access token must be SSO-authorized or login succeeds but scout calls still fail.
- CI with a service token - pin the rotation date in your runbook; a 401 in CI on a Monday morning is usually a weekend rotation.
- Multiple Docker contexts: make sure you log in on the context the scan actually uses, not just the default one.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_HetJ3Rh_gj-s0QHsxo-_vw