glab token

Capture key 685c1cbd7: checksum-verified macOS arm64 binary, source commit 685c1cbd74c882e0c93d7011657adde811582ed7; archive SHA-256 e77f5756c3c8d9ffeaef0bf234533f395680ab9f128a75cec4c1bd7a1049788c. Only fences marked 685c1cbd7 use this capture. Normalization removes trailing spaces/tabs only; indentation, blank lines, wrapping, truncation, and product spelling (including Gitlab) are preserved. Other fences retain their individual prior provenance.

Rotate the current credential

glab token rotate --self (alias rot) rotates the access token currently authenticating the selected host. It requires GitLab 17.9 or later and a token allowed to use the self-rotation endpoint. Confirm the host, visible actor, credential source, and every client sharing that token before approving rotation. The old secret stops working immediately; this is an operational credential write, not an authentication test.

Do not pass a token name/ID, --user, or --group with --self. Without --self, a token name/ID is required. Repository context can select the host; outside a checkout, the default host applies. Use an explicit trusted host context rather than assuming the current token belongs to the intended instance.

--duration defaults to 30d (maximum 365d; hours must be multiples of 24), and --expires-at YYYY-MM-DD is mutually exclusive with it. Expiry is at midnight UTC on the selected date. Default text output is the new secret; JSON output includes it too. Arrange a secure output destination before the approved command, disable shell tracing, and keep both forms out of logs and chat. The command does not persist the new token into glab's config/keyring or replace environment variables: update the approved credential store and dependent clients yourself. If output is lost or the result is uncertain, inspect/recover the credential state rather than blindly retrying rotation.

# Credential-free discovery only
glab token rotate --help
# After approval, capture the secret directly into the approved secure store:
# glab token rotate --self --duration 30d