glab(1)                                                                glab(1)



NAME
       glab-deploy-token-create - Create a deploy token.



SYNOPSIS
       glab deploy-token create  [flags]



DESCRIPTION
       Create a deploy token for a project or a group.


       The token value is printed only once, when the token is created, and
       cannot be retrieved later. Use --output json to capture it from a
       script.


       A deploy token authenticates as a username and token pair, so both
       values from the output are needed to use it.


       The token does not expire unless --expires-at is given.


       Every token must be granted at least one scope with --scope. For the
       scopes you can grant, see
       https://docs.gitlab.com/user/project/deploy_tokens/#scope.



OPTIONS
       -E, --expires-at=   Expiry of the token, as YYYY-MM-DD (00:00 UTC) or
       an RFC 3339 timestamp. The token does not expire if omitted.


       -g, --group=""      Create a deploy token for a group instead of a
       project. Accepts a group ID or full path.


       --jq=""   Filter JSON output with a jq expression.


       -F, --output="text"      Format output as: text, json.


       -R, --repo=""  Select another repository. You can use either OWNER/REPO
       or GROUP/NAMESPACE/REPO. The full URL or Git URL is also accepted.


       -S, --scope=[]      Scope to grant the token. Multiple scopes can be
       comma-separated or specified by repeating the flag.


       --username=""  Username for the token. Defaults to 'gitlab+deploy-
       token-'.



OPTIONS INHERITED FROM PARENT COMMANDS
       -h, --help[=false]  Show help for this command.



EXAMPLE
       # Create a read-only deploy token for the current project
       glab deploy-token create ci-reader --scope read_repository

       # Create a token that can also pull images from the container registry
       glab deploy-token create ci-reader --scope read_repository --scope read_registry

       # Create a token for a specific project, with a custom username
       glab deploy-token create ci-reader --scope read_repository --username ci-reader --repo user/my-repo

       # Create a token that is valid until the end of 2027
       glab deploy-token create ci-reader --scope read_repository --expires-at 2028-01-01

       # Create a group deploy token
       glab deploy-token create ci-reader --scope read_repository --group group/sub-group

       # Create the token that CI/CD jobs receive as CI_DEPLOY_USER and CI_DEPLOY_PASSWORD
       glab deploy-token create gitlab-deploy-token --scope read_registry

       # Create a token and print its username and value from a script
       glab deploy-token create ci-reader --scope read_repository --output json --jq '"\(.username) \(.token)"'



SEE ALSO
       glab-deploy-token(1)

Auto generated by spf13/cobra      Nov 2026                            glab(1)