Docker tokens

• Provider documentation AI Governance API bearerAuth credential table (Format column: dckr_pat_*, dckr_oat_*) · observed 2026-09-23 · Docker's own API reference (docs.docker.com AI Governance API spec, bearerAuth credential table) states the Personal Access Token format as dckr_pat_* and the Organization Access Token format as dckr_oat_*, establishing both prefixes (the * is a glob, not a grammar). Body lengths and alphabet are not provider-stated, except that Docker's Hub API spec (createOrgAccessTokenResponse.token) shows an example OAT with a 27-character alphanumeric body, on example strength only. The 27-character dckr_pat_ body, the 32-character dckr_oat_ width and the [A-Za-z0-9_-] alphabet remain tool-corroborated
• trufflehog 3.97.4
• Reference 1

Re-tiered 2026-09-23 (#112, provider evidence redact-secret#647/#648; OAT width redact-secret#708). The dckr_oat_ branch accepts both exact widths: 27, the only width any Docker-authored artefact shows (the Hub API example; docker/portcullis rules.go, whose comment says it copies the PAT shape), and 32, which comes from TruffleHog 3.97.4 alone (trufflehog PR #4062); the scanners that state 32 trace back to it, so their count is not independent evidence. Each width is exact, so 28-31 and 33 still fail. The empirical measurement of a freshly issued OAT that would settle 27 versus 32 remains open (redact-secret#647); product main accepts both widths since redact-secret#708 (fix dc855b6; known gap product-708 fixed), and the published 0.1.0-beta.6 package still rejects the 27-byte body. The Hub spec's dckr_pat_ examples carry 15-character placeholder bodies and are not a width source. The taxonomy label docker:oauth-access-token says "OAuth", but Docker (and GitHub's docker_organization_access_token pattern) call it an Organization Access Token. Docker-owned scanner rules (docker/portcullis alphanumeric only, docker/mcp-gateway without "_") are narrower than this alphabet; they are code, not documentation, and public-string tallies contradict them.