Can't authenticate HTTP requests to https://ghcr.io/v2

Hello

I’m trying to integrate ghcr into stackrox, which uses docker generic API calls to pull images and check/scan them.

But for some reason I keep getting:
{"errors":[{"code":"DENIED","message":"invalid token"}]}

I’m using a PAT with read:packages scope, that i tested with docker login and it works however not when I do:
curl https://ghcr.io/v2/ -u <username>
or
curl https://ghcr.io/v2/<org>/<image>/manifests/<tag> -u <username>

any ideas what I’m missing? or where to get a valid token?

thanks