Which is expected to be a valid scope, and can be specified more than once for multiple scope requests. You obtained this from the Www-Authenticate response header from the challenge.
service
service:string
Indicates the name of your Azure container registry.
Must be a valid ACR refresh token