glab deploy-token

Manage deploy-token metadata and explicitly approved creation for a project or group. Deploy tokens authenticate with a username/token pair and are separate from personal, project, and group access tokens.

Inspect metadata

list (alias ls) collects all API pages; --active filters out both revoked and expired tokens. get <token-id> selects one numeric ID from the inventory. Both commands clear the token value before JSON serialization; text output contains metadata only. Neither recovers a secret. --output json and --jq support structured metadata selection.

# Credential-free discovery
glab deploy-token --help
glab deploy-token create --help
glab deploy-token get --help

Always select a nonempty explicit --repo <project-path-or-URL> or --group <group-id-or-path> for reads and creation; these flags are mutually exclusive. Without either flag, GITLAB_GROUP selects group scope even inside a project checkout. An explicit --repo suppresses that environment fallback; an explicit --group selects that group instead. A checkout alone does not guarantee project scope.

Confirm the exact host, project/group, and actor before approving any operation. A full project URL pins the repository host. For group scope, a resolvable checkout can still determine the API host; outside a checkout, default/environment host selection applies. Review any configured API-host routing too. --group selects a group, not a host; do not assume it changes the host or that a default host overrides a checkout.