glab(1)

🎀 glab-deploy-token-create 🎀

okay bestie, welcome to the glab(1) manual page for deploy tokens — this is the group-chat explainer version, but the facts are exactly the facts. ✨

---

✨ NAME ✨

glab-deploy-token-create — Create a deploy token.

🦋 SYNOPSIS 🦋

glab deploy-token create  [flags]

💖 DESCRIPTION 💖

Create a deploy token for a project or a group. Periodt.

⚠️ The token value is printed only once, when the token is created, and cannot be retrieved later. Use --output json to capture it from a script. Like, save it somewhere cute immediately — because it is not coming back, bestie. 😭

A deploy token authenticates as a username and token pair, so both values from the output are needed to use it. 🔑

The token does not expire unless --expires-at is given. ⏳

Every token must be granted at least one scope with --scope. For the scopes you can grant, see https://docs.gitlab.com/user/project/deploy_tokens/#scope. 👑

🌸 OPTIONS 🌸

• -E, --expires-at= — Expiry of the token, as YYYY-MM-DD (00:00 UTC) or an RFC 3339 timestamp. The token does not expire if omitted.
• -g, --group="" — Create a deploy token for a group instead of a project. Accepts a group ID or full path.
• --jq="" — Filter JSON output with a jq expression.
• -F, --output="text" — Format output as: text, json.
• -R, --repo="" — Select another repository. You can use either OWNER/REPO or GROUP/NAMESPACE/REPO. The full URL or Git URL is also accepted.
• -S, --scope=[] — Scope to grant the token. Multiple scopes can be comma-separated or specified by repeating the flag.
• --username="" — Username for the token. Defaults to 'gitlab+deploy-token-'.

🫶 OPTIONS INHERITED FROM PARENT COMMANDS 🫶

• -h, --help[=false] — Show help for this command.

🔥 EXAMPLE 🔥

# Create a read-only deploy token for the current project
glab deploy-token create ci-reader --scope read_repository

# Create a token that can also pull images from the container registry
glab deploy-token create ci-reader --scope read_repository --scope read_registry

# Create a token for a specific project, with a custom username
glab deploy-token create ci-reader --scope read_repository --username ci-reader --repo user/my-repo

# Create a token that is valid until the end of 2027
glab deploy-token create ci-reader --scope read_repository --expires-at 2028-01-01

# Create a group deploy token
glab deploy-token create ci-reader --scope read_repository --group group/sub-group

# Create the token that CI/CD jobs receive as CI_DEPLOY_USER and CI_DEPLOY_PASSWORD
glab deploy-token create gitlab-deploy-token --scope read_registry

# Create a token and print its username and value from a script
glab deploy-token create ci-reader --scope read_repository --output json --jq '"\(.username) \(.token)"'

🌈 SEE ALSO 🌈

glab-deploy-token(1) — go check that one too, bestie 💅

---

🫶 Auto generated by spf13/cobra · dated Nov 2026 · this is the glab(1) manual, bestie. 💖