glab-auth
glab auth
Manage GitLab CLI authentication.
Environment credentials and trusted hosts
Environment token, job_token, and is_oauth2 settings resolve only for trusted hosts: the effective default host (including GITLAB_HOST / GITLAB_URI / GL_HOST, or CI_SERVER_FQDN under CI auto-login; otherwise the configured default or gitlab.com), a host in the configuration's hosts map, or the host of a user-set GITLAB_REPO URL or git@host:path value. A bare HOST/OWNER/REPO value does not add trust. HTTP(S) host comparisons retain ports; SSH repository URLs use the hostname without the SSH port.
An arbitrary host supplied only through a command argument, such as a full-URL repository selector, does not receive environment credentials. glab warns when it withholds an environment token. This restriction does not remove explicit per-host stored credentials. Inspect the intended host and actor before approving authentication or changing a host selector; do not add an untrusted destination to configuration merely to suppress a warning. Non-secret environment-backed settings such as api_host still resolve normally, so review those routing settings too.
Default host after login
Successful login can change the global default host used outside a Git repository. If the default is still gitlab.com and there are no credentials for it, glab selects the newly authenticated host automatically. Existing credentials, including an environment token, prevent that automatic switch; unreadable credential storage is treated conservatively. Otherwise interactive login asks first, while non-interactive login prints the glab config set --global host <host> command for a separate approved change. CI and a set GITLAB_HOST, GITLAB_URI, or GL_HOST leave the configured default unchanged. A default-host update failure is a warning after successful authentication.
Inside a checkout, remote-host selection takes precedence over the configured fallback host; an environment-selected host is authoritative and errors when no remote matches it. Verify the host after login before subsequent writes.
The Git credential helper formats its response from the resolved credential: a job token uses gitlab-ci-token, a personal token uses the configured host username (falling back to glab), and an OAuth credential uses oauth2 plus available expiry/refresh fields. Do not infer which token was returned from a separate job_token config lookup. The helper remains a credential-producing command, so do not run it for diagnostics or print its output.