From #625 (comment):

We also need to handle authentication. gcloud auth login is a pattern that we might follow but involves an OAuth transaction that I would rather leave to gcloud. Among auth subcommands, we might have registry auth gcloud to configure the tool to always get its credentials from running $(gcloud print-access-token), registry auth application-default might configure the tool to use application default credentials, and registry auth token might set a specific token. (Should these auth subcommands be under config? They aren't for gcloud but we might argue that different registries require different authentication when they are hosted in different ways. However, because this is unclear, I would default to following the gcloud precedent of keeping them separate.)