debian-mirror-gitlab/doc/user/profile/personal_access_tokens.md
2020-08-09 17:41:57 +05:30

7.8 KiB

type stage group info
concepts, howto Manage Access To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#designated-technical-writers

Personal access tokens

If you're unable to use OAuth2, you can use a personal access token to authenticate with the GitLab API.

You can also use personal access tokens with Git to authenticate over HTTP or SSH. Personal access tokens are required when Two-Factor Authentication (2FA) is enabled. In both cases, you can authenticate with a token in place of your password.

Personal access tokens expire on the date you define, at midnight UTC.

For examples of how you can use a personal access token to authenticate with the API, see the following section from our API Docs.

GitLab also offers impersonation tokens which are created by administrators via the API. They're a great fit for automated authentication as a specific user.

Creating a personal access token

You can create as many personal access tokens as you like from your GitLab profile.

  1. Log in to GitLab.
  2. In the upper-right corner, click your avatar and select Settings.
  3. On the User Settings menu, select Access Tokens.
  4. Choose a name and optional expiry date for the token.
  5. Choose the desired scopes.
  6. Click the Create personal access token button.
  7. Save the personal access token somewhere safe. Once you leave or refresh the page, you won't be able to access it again.

Revoking a personal access token

At any time, you can revoke any personal access token by clicking the respective Revoke button under the Active Personal Access Token area.

Token activity

You can see when a token was last used from the Personal Access Tokens page. Updates to the token usage is fixed at once per 24 hours. Requests to API resources and the GraphQL API will update a token's usage.

Limiting scopes of a personal access token

Personal access tokens can be created with one or more scopes that allow various actions that a given token can perform. The available scopes are depicted in the following table.

Scope Introduced in Description
read_user GitLab 8.15 Allows access to the read-only endpoints under /users. Essentially, any of the GET requests in the Users API are allowed.
api GitLab 8.15 Grants complete read/write access to the API, including all groups and projects, the container registry, and the package registry.
read_api GitLab 12.10 Grants read access to the API, including all groups and projects, the container registry, and the package registry.
read_registry GitLab 9.3 Allows to read (pull) container registry images if a project is private and authorization is required.
sudo GitLab 10.2 Allows performing API actions as any user in the system (if the authenticated user is an admin).
read_repository GitLab 10.7 Allows read-only access (pull) to the repository through git clone.
write_repository GitLab 11.11 Allows read-write access (pull, push) to the repository through git clone. Required for accessing Git repositories over HTTP when 2FA is enabled.

Programmatically creating a personal access token

You can programmatically create a predetermined personal access token for use in automation or tests. You will need sufficient access to run a Rails console session for your GitLab instance.

To create a token belonging to a user with username automation-bot, run the following in the Rails console (sudo gitlab-rails console):

user = User.find_by_username('automation-bot')
token = user.personal_access_tokens.create(scopes: [:read_user, :read_repository], name: 'Automation token')
token.set_token('token-string-here123')
token.save!

This can be shortened into a single-line shell command using the GitLab Rails Runner:

sudo gitlab-rails runner "token = User.find_by_username('automation-bot').personal_access_tokens.create(scopes: [:read_user, :read_repository], name: 'Automation token'); token.set_token('token-string-here123'); token.save!"

NOTE: Note: The token string must be 20 characters in length, or it will not be recognized as a personal access token.

The list of valid scopes and what they do can be found in the source code.

Programmatically revoking a personal access token

You can programmatically revoke a personal access token. You will need sufficient access to run a Rails console session for your GitLab instance.

To revoke a known token token-string-here123, run the following in the Rails console (sudo gitlab-rails console):

token = PersonalAccessToken.find_by_token('token-string-here123')
token.revoke!

This can be shorted into a single-line shell command using the GitLab Rails Runner:

sudo gitlab-rails runner "PersonalAccessToken.find_by_token('token-string-here123').revoke!"