error getting credentials - err: exec: "docker-credential-desktop": executable file not found in %PATH%, out: `` means the Docker client configuration names a credential helper, "credsStore":"desktop", and the program docker-credential-desktop.exe is not in any folder on PATH. Put the helper's folder on PATH, or, as tested only in a separate config folder, use a configuration without that line.

Below, the error came from a docker pull of a public image. With C:\Program Files\Docker\Docker\resources\bin on PATH the same pull succeeded, and so did a pull with a configuration of {}.

The error

PS> $env:DOCKER_CONFIG = "...\c4"   (folder holding only config.json = {"credsStore":"desktop"})
PS> $env:PATH = "C:\Windows\System32"
PS> & "C:\Program Files\Docker\Docker\resources\bin\docker.exe" pull alpine:latest
error getting credentials - err: exec: "docker-credential-desktop": executable file not found in %PATH%, out: ``
exit code: 1

Why it happens

The client reads config.json from the folder in DOCKER_CONFIG (here a test folder of its own). "credsStore":"desktop" tells it to ask an external program, docker-credential-desktop, for registry credentials. The client looks that program up on PATH. On this PC the program lives next to docker.exe in C:\Program Files\Docker\Docker\resources\bin, but with PATH cut down to C:\Windows\System32 it was not found, and the pull printed no Pulling from line before it failed. Calling docker.exe by its full path did not help: the helper was still not found.

Two things have to meet for this error: a credsStore line in the configuration the client reads, and a PATH without the helper's folder. The name in the quotes is docker-credential- followed by the credsStore value, so the message tells you which program to look for and the configuration tells you why it was wanted. Get-Command in the fix shows the first; the config file shows the second. For the test's own folder that was: 

PS> $env:DOCKER_CONFIG = "...\c4"
PS> Get-Content $env:DOCKER_CONFIG\config.json
{"credsStore":"desktop"}

Check both before changing anything.

The fix

Add the folder that holds the helper to the front of PATH, keeping the rest. This ran in a shell started without the helper on its PATH: 

PS> $env:PATH = "C:\Program Files\Docker\Docker\resources\bin;" + $env:PATH
PS> Get-Command docker-credential-desktop | Select-Object -ExpandProperty Source
C:\Program Files\Docker\Docker\resources\bin\docker-credential-desktop.exe
PS> docker pull alpine@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
...
Status: Image is up to date for alpine@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
docker.io/library/alpine@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
exit code: 0

The narrowed PATH of C:\Windows\System32 in the error belonged to the test; do not copy it, because assigning it replaces your session's PATH. The second way is a configuration without credsStore. With a config.json holding only {} and PATH still cut down to C:\Windows\System32, the same pull ended with exit code: 0. That was a test folder made for this post; the user's real config.json was left alone, so the PATH fix is the one shown first. The pull above used a digest so the test left the cached alpine:latest tag as it was.

How it was reproduced

In PowerShell 5.1 on Windows 11 with Docker Desktop, client and engine 29.9.3: DOCKER_CONFIG pointed at a new folder whose config.json held only {"credsStore":"desktop"}, PATH was set to C:\Windows\System32 for the one command, and docker.exe was called by its full path to pull alpine:latest. The user's own Docker configuration was not read or changed.

Frequently asked

What does 'docker-credential-desktop executable file not found in %PATH%' mean?
config.json names the desktop credential helper with credsStore, and docker-credential-desktop.exe is not in a folder on PATH. The pull stopped before anything was downloaded.
Where is docker-credential-desktop.exe on Windows?
On the test PC it was in C:\Program Files\Docker\Docker\resources\bin, next to docker.exe. Get-Command docker-credential-desktop shows where it is on yours.
Can I remove credsStore from Docker config.json?
In the test, a config.json of {} in a test folder let the pull of a public image run without the helper. Removing it from your own config.json was not tested here, and neither was what that does to logins the helper stores; prefer the PATH fix, which leaves the configuration as it is.

More decoded errors in the Fixes category.