Project access tokens

Introduced in GitLab 13.0.

Became available on GitLab.com in GitLab 13.5 for paid groups only.

Feature flag removed in GitLab 13.5.

Changed in GitLab 14.5. Default prefix added.

You can use a project access token to authenticate:

With the GitLab API.
With Git, when using HTTP Basic Authentication.

After you configure a project access token, you don't need a password when you authenticate. Instead, you can enter any non-blank value.

Project access tokens are similar to personal access tokens, except they are associated with a project rather than a user.

You can use project access tokens:

On GitLab SaaS if you have the Premium license tier or higher. Personal access tokens are not available with a trial license.
On self-managed instances of GitLab, with any license tier. If you have the Free tier:
- Review your security and compliance policies around user self-enrollment.
- Consider disabling project access tokens to lower potential abuse.

Project access tokens inherit the default prefix setting configured for personal access tokens.

Create a project access token

To create a project access token:

On the top bar, select Menu > Projects and find your project.
On the left sidebar, select Settings > Access Tokens.
Enter a name.
Optional. Enter an expiry date for the token. The token will expire on that date at midnight UTC.
Select a role for the token.
Select the desired scopes.
Select Create project access token.

A project access token is displayed. Save the project access token somewhere safe. After you leave or refresh the page, you can't view it again.

Revoke a project access token

To revoke a project access token:

On the top bar, select Menu > Projects and find your project.
On the left sidebar, select Settings > Access Tokens.
Next to the project access token to revoke, select Revoke.

Scopes for a project access token

The scope determines the actions you can perform when you authenticate with a project access token.

Scope	Description
`api`	Grants complete read and write access to the scoped project API, including the Package Registry.
`read_api`	Grants read access to the scoped project API, including the Package Registry.
`read_registry`	Allows read access (pull) to the Container Registry images if a project is private and authorization is required.
`write_registry`	Allows write access (push) to the Container Registry.
`read_repository`	Allows read access (pull) to the repository.
`write_repository`	Allows read and write access (pull and push) to the repository.

Enable or disable project access token creation

Introduced in GitLab 13.11.

To enable or disable project access token creation for all projects in a top-level group:

On the top bar, select Menu > Groups and find your group.
On the left sidebar, select Settings > General.
Expand Permissions, LFS, 2FA.
Under Permissions, turn on or off Allow project access token creation.

Even when creation is disabled, you can still use and revoke existing project access tokens.

Group access tokens (FREE SELF)

With group access tokens, you can use a single token to:

Perform actions for groups.
Manage the projects within the group.
In GitLab 14.2 and later, authenticate with Git over HTTPS.

NOTE: You cannot use the UI to create a group access token. An issue exists to add this functionality. This section describes a workaround.

If you are an administrator of a self-managed GitLab instance, you can create a group access token in the Rails console.

For a demo of the group access token workaround, see Demo: Group Level Access Tokens.

Create a group access token

To create a group access token:

Run the following commands in a Rails console:

# Set the GitLab administration user to use. If user ID 1 is not available or is not an adinistrator, use 'admin = User.admins.first' instead to select an admininistrator.
admin = User.find(1)

# Set the group group you want to create a token for. For example, group with ID 109.
group = Group.find(109)

# Create the group bot user. For further group access tokens, the username should be group_#{group.id}_bot#{bot_count}. For example, group_109_bot2 and email address group_109_bot2@example.com.
bot = Users::CreateService.new(admin, { name: 'group_token', username: "group_#{group.id}_bot", email: "group_#{group.id}_bot@example.com", user_type: :project_bot }).execute

# Confirm the group bot.
bot.confirm

# Add the bot to the group with the required role.
group.add_user(bot, :maintainer)

# Give the bot a personal access token.
token = bot.personal_access_tokens.create(scopes:[:api, :write_repository], name: 'group_token')

# Get the token value.
gtoken = token.token

Test if the generated group access token works:
1. Use the group access token in the PRIVATE-TOKEN header with GitLab REST APIs. For example:
  - Create an epic in the group.
  - Create a project pipeline in one of the group's projects.
  - Create an issue in one of the group's projects.
2. Use the group token to clone a group's project using HTTPS.

Revoke a group access token

To revoke a group access token, run the following command in a Rails console:

bot = User.find_by(username: 'group_109_bot') # the owner of the token you want to revoke
token = bot.personal_access_tokens.last # the token you want to revoke
token.revoke!

Project bot users

Introduced in GitLab 13.0.

Excluded from license seat use in GitLab 13.5.

Project bot users are GitLab-created service accounts. Each time you create a project access token, a bot user is created and added to the project. These bot users do not count as licensed seats.

The bot users have permissions that correspond with the selected role and scope of the project access token.

The name is set to the name of the token.
The username is set to project_{project_id}_bot for the first access token. For example, project_123_bot.
The email is set to project{project_id}_bot@example.com. For example, project123_bot@example.com.
For additional access tokens in the same project, the username is set to project_{project_id}_bot{bot_count}. For example, project_123_bot1.
For additional access tokens in the same project, the email is set to project{project_id}_bot{bot_count}@example.com. For example, project123_bot1@example.com.

API calls made with a project access token are associated with the corresponding bot user.

Bot users:

Are included in a project's member list but cannot be modified.
Cannot be added to any other project.

When the project access token is revoked:

The bot user is deleted.
All records are moved to a system-wide user with the username Ghost User. For more information, see associated records.