How to fix Error response from daemon: unauthorized: two-factor authentication is required in Docker

Since 2FA is enabled on your account, you need to create a Personal Access Token (PAT) to use for CLI authentication.

Create your access token:
1. Go to [hub.docker.com](https://hub.docker.com) and sign in
2. Click your username in the top-right corner
3. Select Account Settings
4. Click Security in the left sidebar
5. Click New Access Token
6. Enter a description (e.g., "CLI access" or "CI/CD pipeline")
7. Select permissions:
- Read-only - For pulling images only
- Read, Write - For pushing and pulling images
- Read, Write, Delete - Full access including image deletion
8. Click Generate
9. Copy the token immediately - it won't be shown again

Important: Store this token securely. Treat it like a password.

Now use the access token instead of your password:

# Log out first to clear cached credentials
docker logout

# Log in with your username
docker login -u YOUR_USERNAME
# When prompted for password, paste your Personal Access Token (NOT your password)

Alternatively, use the --password-stdin flag for a non-interactive login:

echo "YOUR_ACCESS_TOKEN" | docker login -u YOUR_USERNAME --password-stdin

Verify the login succeeded:

# Check authentication status
docker info | grep Username

# Test by pulling a private image or listing your repos
docker search YOUR_USERNAME/

If your CI/CD pipeline is failing, update it to use the Personal Access Token.

GitHub Actions:

- name: Login to Docker Hub
  uses: docker/login-action@v3
  with:
    username: ${{ secrets.DOCKERHUB_USERNAME }}
    password: ${{ secrets.DOCKERHUB_TOKEN }}  # Use PAT, not password

Update your GitHub secrets:
1. Go to your repository > Settings > Secrets and variables > Actions
2. Update DOCKERHUB_TOKEN with your new Personal Access Token

GitLab CI:

docker-build:
  script:
    - echo "$DOCKER_TOKEN" | docker login -u "$DOCKER_USER" --password-stdin

Update GitLab CI/CD variables:
1. Go to Settings > CI/CD > Variables
2. Update the DOCKER_TOKEN variable with your Personal Access Token

Jenkins:

withCredentials([usernamePassword(
  credentialsId: 'docker-hub-creds',
  usernameVariable: 'DOCKER_USER',
  passwordVariable: 'DOCKER_TOKEN'
)]) {
  sh 'echo $DOCKER_TOKEN | docker login -u $DOCKER_USER --password-stdin'
}

Update your Jenkins credentials store with the new access token.

If login still fails after using the correct token, clear your cached Docker credentials:

Check your credential storage method:

cat ~/.docker/config.json

If you see "credsStore": "desktop" or similar, credentials are managed by a credential helper.

Clear credentials on macOS:

# Remove from Docker Desktop credential store
docker logout

# Or manually from Keychain Access app
# Search for "docker" and remove entries for registry-1.docker.io

Clear credentials on Windows:
1. Open Credential Manager (search in Start menu)
2. Click "Windows Credentials"
3. Find entries for docker.io or registry-1.docker.io
4. Remove them
5. Run docker logout and then docker login again

Clear credentials on Linux:

# Log out
docker logout

# Remove Docker config (will require re-login)
rm ~/.docker/config.json

# Or if using pass/secretservice
secret-tool clear server registry-1.docker.io

Then log in again with your Personal Access Token.

Docker Desktop and recent CLI versions support a browser-based device code authentication flow that works seamlessly with 2FA:

# Simply run docker login without username/password
docker login

This will:
1. Display a code and URL in your terminal
2. Open your browser (or provide a URL to open)
3. Ask you to enter the code and authenticate via browser
4. Complete authentication including 2FA verification

This flow is more secure and convenient because:
- You authenticate in your browser where 2FA works normally
- No password or token is entered in the terminal
- The session is automatically managed by Docker Desktop

Note: This requires Docker Desktop or a recent version of the Docker CLI.