glab(1)

NAME

glab-deploy-token-create - Create a deploy token.

SYNOPSIS

glab deploy-token create [flags]

DESCRIPTION

Create a deploy token for a project or a group.

The token value is printed only once, when the token is created, and cannot be retrieved later. Use --output json to capture it from a script.

A deploy token authenticates as a username and token pair, so both values from the output are needed to use it.

The token does not expire unless --expires-at is given.

Every token must be granted at least one scope with --scope. For the scopes you can grant, see https://docs.gitlab.com/user/project/deploy_tokens/#scope.

OPTIONS

-E, --expires-at= Expiry of the token, as YYYY-MM-DD (00:00 UTC) or an RFC 3339 timestamp. The token does not expire if omitted.

-g, --group="" Create a deploy token for a group instead of a project. Accepts a group ID or full path.

--jq="" Filter JSON output with a jq expression.

-F, --output="text" Format output as: text, json.

-R, --repo="" Select another repository. You can use either OWNER/REPO or GROUP/NAMESPACE/REPO. The full URL or Git URL is also accepted.

-S, --scope=[] Scope to grant the token. Multiple scopes can be comma-separated or specified by repeating the flag.

--username="" Username for the token. Defaults to 'gitlab+deploy-token-'.

OPTIONS INHERITED FROM PARENT COMMANDS

-h, --help[=false] Show help for this command.

EXAMPLE

# Create a read-only deploy token for the current project
glab deploy-token create ci-reader --scope read_repository
# Create a token that can also pull images from the container registry
glab deploy-token create ci-reader --scope read_repository --scope read_registry
# Create a token for a specific project, with a custom username
glab deploy-token create ci-reader --scope read_repository --username ci-reader --repo user/my-repo
# Create a token that is valid until the end of 2027
glab deploy-token create ci-reader --scope read_repository --expires-at 2028-01-01
# Create a group deploy token
glab deploy-token create ci-reader --scope read_repository --group group/sub-group
# Create the token that CI/CD jobs receive as CI_DEPLOY_USER and CI_DEPLOY_PASSWORD
glab deploy-token create gitlab-deploy-token --scope read_registry
# Create a token and print its username and value from a script
glab deploy-token create ci-reader --scope read_repository --output json --jq '"\(.username) \(.token)"'