Gitlab Authentication

generated: '2026-11-05'
method: searched
source: https://docs.gitlab.com/api/rest/authentication/
docs: https://docs.gitlab.com/api/rest/authentication/
summary:
  types:
  - apiKey
  - http
  - oauth2
  api_key_in:
  - header
  - query
note: 'Most API requests require authentication or return only public data. Missing/invalid credentials return 401 {"message": "401 Unauthorized"}; insufficient scope returns a WWW-Authenticate Bearer challenge
  listing the required scopes. Deploy tokens cannot be used with the public API. Using the API to generate a new session cookie is not supported.'
schemes:
- name: oauthToken
  type: http
  scheme: bearer
  description: 'OAuth 2.0 access token, passed as Authorization: Bearer or access_token query parameter (not both). Access tokens are valid for two hours; refresh with refresh_token.'
  docs: https://docs.gitlab.com/api/oauth2/
  sources:
  - openapi/gitlab-oauth2-openapi.yml
  - openapi/gitlab-webhooks-openapi.yml
  - https://docs.gitlab.com/api/rest/authentication/
- name: privateToken
  type: apiKey
  in: header
  parameter: PRIVATE-TOKEN
  description: 'Personal, project or group access token; PRIVATE-TOKEN header is recommended, also accepted as Authorization: Bearer. Project access tokens on GitLab.com require Premium or Ultimate.'
  sources:
  - openapi/gitlab-webhooks-openapi.yml
  - openapi/gitlab-openapi-original.yml
  - https://docs.gitlab.com/api/rest/authentication/
- name: jobToken
  type: apiKey
  in: header
  parameter: JOB-TOKEN
  description: CI/CD job token ($CI_JOB_TOKEN), specific endpoints only.
  docs: https://docs.gitlab.com/ci/jobs/ci_job_token/
  sources:
  - https://docs.gitlab.com/api/rest/authentication/
- name: sessionCookie
  type: apiKey
  in: cookie
  parameter: _gitlab_session
  description: Set by signing in to the GitLab web app; the API uses it if present.
  sources:
  - https://docs.gitlab.com/api/rest/authentication/
- name: impersonationAndSudo
  type: apiKey
  in: header
  parameter: Sudo
  description: Administrators can act as a specific user with impersonation tokens (a type of personal access token) or Sudo (sudo query parameter or Sudo header, token needs the sudo scope).
  sources:
  - https://docs.gitlab.com/api/rest/authentication/
see:
- scopes/gitlab-scopes.yml
- conventions/gitlab-conventions.yml