KeyKeeperGitLab.com · Project access token
How an agent gets a GitLab.com · Project access token key through KeyKeeper, what to choose on gitlab.com, and how KeyKeeper verifies it.
| Template id | gitlab |
|---|---|
| Field | gitlab-token → GITLAB_TOKEN · secret |
| Key looks like | starts with glpat-, shown once when created |
| Created at | gitlab.com |
| Verified by KeyKeeper | not verified |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show gitlab
keykeeper save --provider gitlab --from-clipboard --create --purpose "what this task does"
keykeeper run -c gitlab -- <your command>--provider gitlab fills in the credential id and the field. The environment
variable is the one GitLab.com · Project access token's own tools read, so nothing has to be mapped.
What only you can do
Sign in to GitLab.com with 2FA/SSO
Open the target project → Settings → Access tokens
Select scopes and an expiration
Copy the key, then approve the save in KeyKeeper's window.
What to choose
Use read_repository for inspection and add write_repository only for pushing. Repository-only tokens intentionally skip the /user API probe.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a GitLab.com · Project access token key (starts with
glpat-, shown once when created). A wrong paste is refused before anything is stored, and the agent is told why — without the value. - After saving: GitLab.com · Project access token offers no read-only endpoint KeyKeeper can use, so the first real call is the test.
Rotation and expiry
No universal expiry policy was confirmed for this credential type. Record the date shown by the provider, or leave it unknown. Rotate or revoke at gitlab.com.