glab(1)

✨ NAME ✨

glab-token-rotate — bestie, this is the glow-up command: it rotates user, group, or project access tokens 💅

(oh and hi, you're reading the glab(1) manual, welcome to the group chat 🫶)

---

🌸 SYNOPSIS 🌸

glab token rotate [] [flags]

---

🦋 DESCRIPTION 🦋

okay so real talk: rotating a token revokes the existing one and creates a brand new one with a fresh secret value and a new expiration date. The old token stops working immediately — like, not "in a minute", not "after the cache clears", immediately — so you literally must go update every single client that's using it with the new value this command hands back to you. No cap, don't skip that part 😭

If multiple tokens share the same name, you gotta specify the token ID so you pick the correct one. Names are not unique bestie, act accordingly.

The token expires at 00:00 UTC on a date calculated by adding the duration to today's date. Default duration is 30 days. You can specify a different duration in days (d), weeks (w), or hours (h). Heads up: --duration and --expires-at are mutually exclusive — pick one, you can't have both 🎀

Administrators can rotate personal access tokens that belong to other users. iconic admin energy, honestly 👑

Use --self to rotate the token currently used for authentication. This command requires GitLab 17.9 or later, so vibe check your instance version first.

---

💖 OPTIONS 💖

• -D, --duration=30d — Sets the token lifetime in days. Accepts: days (30d), weeks (4w), or hours in multiples of 24 (24h, 168h, 720h). Maximum: 365d. The token expires at 00:00 UTC on the calculated date ⏰
• -E, --expires-at=0001-01-01 — Sets the token's expiration date and time, in YYYY-MM-DD format. If not specified, --duration is used.
• -g, --group="" — Rotate group access token. Ignored if a user or repository argument is set. (like, it just minds its own business 🙈)
• --jq="" — Filter JSON output with a jq expression.
• -F, --output="text" — Format output as: text, json. 'text' provides the new token value; 'json' outputs the token with metadata.
• -R, --repo="" — Select another repository. You can use either OWNER/REPO or GROUP/NAMESPACE/REPO. The full URL or Git URL is also accepted.
• --self[=false] — Rotate the access token currently used for authentication 🪞
• -U, --user="" — Rotate personal access token. Use @me for the current user.

🔮 OPTIONS INHERITED FROM PARENT COMMANDS 🔮

• -h, --help[=false] — Show help for this command. the classic, the icon, the legend 💫

---

🎀 EXAMPLE 🎀

# Rotate project access token of current project (default 30 days)
glab token rotate my-project-token

# Rotate project access token with explicit expiration date
glab token rotate --repo user/repo my-project-token --expires-at 2025-08-08

# Rotate group access token with 7 day lifetime
glab token rotate --group group/sub-group my-group-token --duration 7d

# Rotate personal access token with 2 week lifetime
glab token rotate --user @me my-personal-token --duration 2w

# Rotate a personal access token of another user (administrator only)
glab token rotate --user johndoe johns-personal-token --duration 90d

# Rotate the current authentication token
glab token rotate --self --duration 90d

see how easy that was? slay 💅

---

🌈 SEE ALSO 🌈

glab-token(1) — go read the parent page too, iykyk 🧚

---

quick recap so you don't get caught slipping: the old token dies the second you run this, so update your clients with the new value this command returns. periodt.

Auto generated by spf13/cobra ✨ that's the source/version, and this lil cutie is dated Nov 2026 — catch you in the next glab(1) page, bestie 💜🍓