async def get_image_manifest(self, image, tag):
        """
        Get the manifest for an image.

        image: The image name without the registry and tag
        tag: The image tag
        """
        client = httpclient.AsyncHTTPClient()
        url = f"{self.url}/v2/{image}/manifests/{tag}"
        token = None
        # first, get a token to perform the manifest request
        if self.token_url:
            token = await self._get_token(
                client,
                self.token_url,
                scope=f"repository:{image}:pull",
                service="container_registry",
            )
            req = httpclient.HTTPRequest(
                url,
                headers={"Authorization": f"Bearer {token}"},
            )
        else:
            # Use basic HTTP auth (htpasswd)
            req = httpclient.HTTPRequest(
                url,
                auth_username=self.username,
                auth_password=self.password,
            )

        self.log.debug(f"Getting image manifest from {url}")
        try:
            resp = await client.fetch(req)
        except httpclient.HTTPError as e:
            if e.code == 404:
                # 404 means it doesn't exist
                return None
            elif e.code == 401 and token and self.not_found_401:
                # token-authenticated requests may give 401 on nonexistent repos,
                # e.g. on Docker Hub
                # WARNING: this is hard to distinguish from a real permission error!
                # but if we were issued a token, at least we know we have valid credentials,
                # even if they are not permitted access to this repo
                self.log.debug(
                    "Interpreting 401 error as not found on %s:%s", image, tag
                )
                return None
            elif (
                e.code == 401 and not token and "www-authenticate" in e.response.headers
            ):
                # Unauthorised. If we don't have a token, try and get one using
                # information from the WWW-Authenticate header
                # https://stackoverflow.com/questions/56193110/how-can-i-use-docker-registry-http-api-v2-to-obtain-a-list-of-all-repositories-i/68654659#68654659
                www_auth_header = e.response.headers["www-authenticate"]
                return await self._get_image_manifest_from_www_authenticate(
                    client, www_auth_header, url
                )
            else:
                raise
        return json.loads(resp.body.decode("utf-8"))

        Get the manifest for an image.

        image: The image name without the registry and tag
        tag: The image tag
        
binderhub/registry.py