How to push to Zot that is using OIDC login?

[FlexibleToast]

My config is as:

storage:
    rootDirectory: /var/lib/registry
    dedupe: true
http:
  address: 0.0.0.0
  port: '5000'
  externalUrl: 'https://zot.<redacted>'
  realm: zot
  auth:
    openid:
      providers:
        oidc:
          name: Authentik
          issuer: 'https://authentik.<redacted>/application/o/zot/'
          clientid: <redacted>
          clientsecret: <redacted>
          scopes:
            - openid
            - user
            - email
            - groups
    failDelay: 5
  accessControl:
    repositories:
      '**':
        policies:
          - users:
              - FlexibleToast
            actions:
              - read
              - create
        defaultPolicy:
            - read
log:
  level: debug
extensions:
  search:
    enable: true
    cve:
        updateInterval: 2h
  ui:
    enable: true
  mgmt:
    enable: true

This works great at the web UI. I can login using Authentik and I get to see that nothing is there. When I try to push to it, it gets rejected because I need to authenticate, but I don't know how? I tried creating an api key and then using that as a password. I'm not sure what I'm supposed to do in order to push as my user to Zot?

[andaaron]

This is the main reason why we implemented the API keys feature. You could login to the web based ui, generate an API key, and then use it for authentication when pushing images.

[FlexibleToast]

I guess in that case I'm not sure how to use the api key. I'll look that up.

[FlexibleToast]

I figured it out. It's using my email address and not my username. I don't know if that's expected behavior, or something I need to change with my oidc configuration.

[andaaron]

Using the email is expected