JFrog Artifactory
Connect JFrog Artifactory or JFrog Container Registry to Safeguard. The permissions each credential needs, which tokens work, and step-by-step setup.
Availability
This integration is switched on per workspace. If you do not see the card under Integrations, ask your Safeguard contact.
What it does
The JFrog Artifactory card connects Safeguard to the Docker and OCI repositories in JFrog Artifactory or JFrog Container Registry, on SaaS (*.jfrog.io) or self-hosted. Safeguard lists your local, remote, virtual and federated Docker repositories, every image in them and every tag, and each image you select becomes a project that Safeguard scans for an SBOM and vulnerability findings. Each scan is pinned to the digest the tag points at when the scan starts, and pulls the image with the credential you connect. Find the card under Integrations on the Project/Product tab.
Public vs private
| Public | Private | |
|---|---|---|
| What you enter | The JFrog platform URL | The JFrog platform URL and an access token, or a username with a password, identity token or API key |
| Credential needed | None. Anonymous access must be on, and the anonymous user must have Read on the Docker repositories | One of the credentials below |
| What you can scan | The Docker repositories anonymous users can read | Every Docker repository the credential can read, or the repositories you name |
Supported auth methods
| Method (dialog label) | Use it when | Notes |
|---|---|---|
| Access token | Recommended | A scoped token, sent as a bearer token. Safeguard reads the token's user from it for Docker pulls; enter Username only for a reference token |
| Password | No tokens are allowed on your platform | A dedicated read-only user is best |
| Identity token | A user's own identity token | Enter that user's name |
| API key | Older setups only | Deprecated by JFrog and may be turned off on your platform |
Permissions required
Safeguard only reads. It never deploys, deletes or promotes images, and never changes platform settings, except the webhook you add yourself (below).
Access token
| Permission | Required? | What Safeguard uses it for |
|---|---|---|
Read on each Docker repository (through the token's scope: applied-permissions/user of a read-only user, or applied-permissions/groups:<group> of a group with Read) | Required | Listing repositories (/api/repositories), images and tags (/api/docker/<repository key>/v2/), reading manifests for digests and pulling images |
| Annotate, Deploy/Cache, Delete/Overwrite, Manage | Not used | Safeguard never writes |
Least privilege: a token scoped to a group (or user) that has only Read on the Docker repositories to scan. The default readers group is enough on most platforms.
Password, identity token or API key
| Permission | Required? | What Safeguard uses it for |
|---|---|---|
| Read on each Docker repository, for the user | Required | The same calls as above, with Basic authentication |
Least privilege: a user that belongs only to a group with Read on the Docker repositories.
Token types
| Credential type | Works? | Notes |
|---|---|---|
Scoped access token (applied-permissions/groups:<group> or applied-permissions/user) | Yes (recommended) | Created by an administrator; give it an expiry |
| Identity token | Yes | A user creates it in Edit Profile; it carries that user's permissions |
| Username and password | Yes | Use a dedicated read-only user |
| API key | Yes, deprecated | JFrog has deprecated API keys and may turn them off |
| Reference token | Yes | Enter the token's Username too, because Safeguard cannot read it from the token |
Admin token (applied-permissions/admin) | Works, not recommended | Far more than Safeguard needs |
Expiry: set access tokens to expire in 90 days or less, and rotate before they do. An expired token fails with "Token failed verification: expired".
What we never need: admin rights, Deploy/Cache, Delete/Overwrite, Manage, or any permission on non-Docker repositories.
Step-by-step setup
Create the credential in JFrog
- As an administrator, open Administration > User Management > Groups and create a group (for example
safeguard-read), or usereaders. - Open Administration > User Management > Permissions > New Permission, add the Docker repositories, give the group Read only and save.
- Open Administration > User Management > Access Tokens > Generate Token. Choose Scoped Token, token scope Group with the group above (or User with a read-only user), set Expiration and generate. Copy the token; JFrog shows it once.
Or with the JFrog CLI
# A read-only token for the safeguard-read group, valid for 90 days
jf access-token-create --groups safeguard-read --expiry 7776000Connect it in Safeguard
- Open Integrations and choose the Project/Product tab.
- Click Connect on the JFrog Artifactory card.
- Choose Private (or Public for anonymous access), enter a Name and the JFrog platform URL, for example
https://acme.jfrog.ioorhttps://artifactory.example.com. - Private: pick the Sign-in method and paste the access token (or enter the Username and the password, identity token or API key).
- Docker access method: how Docker clients reach your repositories. Repository path is
<host>/<repository key>/<image>(the SaaS default). Subdomain is<server>-<repository key>.jfrog.ioon SaaS or<repository key>.<host>self-hosted. Port takes one<repository key>=<host:port>entry per repository. - Repositories (optional): limit listing to some Docker repositories. A virtual repository is listed only when you name it here, so its images are not listed twice.
- Click Verify Credentials. "Connected. N Docker repositories are readable." means JFrog accepted the credential.
- Click Next, select images and tags, and choose a connect option (fast, progressive or deep scan).
Webhooks and triggers
Scan on push is optional. Open the connection's edit dialog and expand Scan on push (optional) for the Webhook URL (https://api.safeguard.sh/scm/api/v1/registry-webhooks/artifactory/<connection id>) and the Secret. In the JFrog Platform, open Administration > General > Webhooks > Create a Webhook, choose the Docker event "Docker tag was pushed" (event pushed in the docker domain) for the connected repositories, paste the URL, put the secret in Secret token and tick Use secret for payload signing.
With signing on, JFrog sends an HMAC-SHA256 of the body in X-JFrog-Event-Auth; without it, the header carries the secret itself. Safeguard accepts either and refuses anything else. A pushed tag is scanned as the version <tag>-<first 12 characters of the digest>. Without a webhook, rescan on a schedule under Integrations > Scheduled.
What we read and store
- Read: Docker repository keys and types, image names, tags and manifest digests, and the images you select for scanning.
- Stored: the connection's settings, the SBOM and findings of each scanned image with its digest, and the credential, which is encrypted at rest and never shown again after you save it.
- Not stored: image layers. The image is read for the scan and not kept. Safeguard does not read npm, Maven, PyPI or other package repositories through this card.
- No customer data from this integration is sent to third-party LLMs.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
JFrog Artifactory rejected the credential (Token failed verification: expired). Check the access token has not expired or been revoked ... | An expired or revoked token, a wrong password, or API keys turned off | Create a new access token |
The credential signed in but can read no Docker or OCI repositories. Give it Read on them (a permission, or a group such as readers). | The user or group has no Read on Docker repositories | Add a permission with Read |
The JFrog account cannot read <repository> ... Give it Read on the Docker repositories ... | Read is missing for that repository | Add the repository to the permission |
The access token is valid, but Safeguard cannot tell which user it belongs to (it is a reference token). Enter that username too: Docker pulls need it. | A reference token without a username | Enter the token's user in Username |
No JFrog Artifactory REST API at <url>/artifactory. Check the platform URL ... | Wrong URL | Use the platform URL, without /ui |
JFrog Artifactory at <host> does not allow anonymous reads ... | Public tab without anonymous access | Turn anonymous access on with Read, or use the Private tab |
The TLS certificate of <host> is not trusted ... | A self-signed or private certificate | Serve Artifactory with a certificate from a public certificate authority |
Rotation and disconnect
- Rotate: create a new access token, find the connection under Project Configurations on the Project/Product tab, choose Update, paste the new token, verify and save, then revoke the old token under Access Tokens.
- Disconnect: choose Delete from the connection's menu under Project Configurations and confirm. Then revoke the token (or remove the user) and delete the webhook that points at Safeguard.
Vendor references
- Get Repositories, checked 2026-10-16.
- Docker Repository URL Formats, checked 2026-10-16.
- Access Tokens, checked 2026-10-16.
- Webhook Event Types, checked 2026-10-16.
- Custom Webhooks, checked 2026-10-16.