344

I want to clone GitLab repository without prompt for my automation script, by using my private token from my GitLab account.

Can someone provide me a sample?

I know I can do so with user and password:

git clone https://" + user + ":" + password + "@" + gitlaburl;

and I know it is possible with ssh key

But, both options are insufficient.

4
  • 91
    git clone https://<token-name>:<token>@gitlaburl
    – Kinght 金
    Commented May 10, 2019 at 3:44
  • 9
    for me the usefull syntax was: https://$GIT_USERNAME:$GITLAB_PERSONAL_ACCESS_TOKEN@gitlaburl Commented May 20, 2021 at 12:58
  • for me the usefull syntax was: pat:<token>@gitlab.com/org/proj Commented Nov 1, 2022 at 18:18
  • Using a token IS authentication.
    – dolmen
    Commented Jul 10 at 11:38

20 Answers 20

509

This is how you do it:

git clone https://oauth2:[email protected]/vendor/package.git
16
  • 3
    This worked for me on GitLab 8.5.7 Enterprise Edition. Commented Aug 5, 2016 at 2:45
  • 23
    It works! I wonder why on gitlab.com on project details they don't give the complete command syntax :-((
    – FRa
    Commented Feb 28, 2018 at 17:16
  • 4
    The oauth2 portion is probably arbitrary. I put the name of the access token instead. Commented Oct 16, 2018 at 20:19
  • 9
    How to use this over ssh?
    – hemu
    Commented Apr 2, 2019 at 6:00
  • 9
    Even read_api and write_api permissions are not enough. You have to have api. Commented Dec 2, 2020 at 14:48
146

The gitlab has a lot of tokens:

  • Private token
  • Personal Access Token
  • CI/CD running token

I tested only the Personal Access Token using GitLab Community Edition 10.1.2, the example:

git clone https://gitlab-ci-token:${Personal Access Tokens}@gitlab.com/username/myrepo.git


git clone https://oauth2:${Personal Access Tokens}@gitlab.com/username/myrepo.git

or using username and password:

git clone https://${username}:${password}@gitlab.com/username/myrepo.git

or by input your password:

git clone https://${username}@gitlab.com/username/myrepo.git

But the private token seems can not work.

5
  • 9
    Note that private tokens were removed in favour of personal access tokens in GitLab 10.2: about.gitlab.com/2017/09/22/gitlab-10-0-released/… Commented Nov 11, 2018 at 6:05
  • And about user+password+token? How to express all in one URL? Now my gitlab-software server use all, login and two-factor (or token). Commented Jan 6, 2021 at 22:53
  • 4
    what are the differences for gitlab-ci-token, oauth2 and x-access-token? all of these 3 work for me.
    – Lei Yang
    Commented Apr 20, 2022 at 6:44
  • If i understand it correctly, the first part does not matter. When using a Gitlab token access, you can provide any (non blank) username with it : docs.gitlab.com/ee/user/project/settings/…
    – tycyly
    Commented Jun 12 at 8:49
  • you can also use your gitlab username besides oauth2 and x-access-token
    – mati kepa
    Commented Jul 16 at 6:51
66

Use the token instead of the password (the token needs to have "api" scope for clone to be allowed):

git clone https://username:[email protected]/user/repo.git

Tested against 11.0.0-ee.

5
  • 9
    For people Googling this: this is what you want if using Personal Access Tokens over HTTPS on gitlab.com.
    – Adam
    Commented Aug 10, 2019 at 13:50
  • 26
    Isn't it amazing that we have to find this here and not on the GitLab Docs page on Personal Access Tokens?
    – cryanbhu
    Commented Feb 14, 2021 at 5:54
  • 1
    Thx for "the token needs to have "api" scope for clone to be allowed"!
    – MingalevME
    Commented Aug 19, 2022 at 9:44
  • Why would the token need to have api scope for the clone to be allowed? Is the API actually called?
    – Myer
    Commented May 6 at 18:18
  • This the correct answer in year 2024!
    – Elmar
    Commented Jun 13 at 7:02
55

You can do it like this:

git clone https://gitlab-ci-token:<private token>@git.example.com/myuser/myrepo.git
9
  • 3
    this seems right but it always fails authentication for me :(
    – Randyaa
    Commented Apr 25, 2016 at 1:52
  • same to me: fatal: Authentication failed for
    – vogash
    Commented May 3, 2016 at 10:22
  • 6
    <private token> needs to be replaced with the CI runner's token, not the account's private token.
    – Kip
    Commented Jun 2, 2016 at 15:08
  • 2
    i think you should also be able to use your personal token right @tim
    – Gobi Dasu
    Commented Jul 2, 2016 at 10:55
  • You can use the project specific ci token (enable builds, then go to the project/runners config).
    – BM5k
    Commented Jul 26, 2016 at 19:10
38

If you already has a repository and just changed the way you do authentication to MFA, u can change your remote origin HTTP URI to use your new api token as follows:

git remote set-url origin https://oauth2:TOKEN@ANY_GIT_PROVIDER_DOMAIN/YOUR_PROJECT/YOUR_REPO.git

And you wont need to re-clone the repository at all.

1
  • 8
    git clone https://oauth2:TOKEN@ANY_GIT_PROVIDER_DOMAIN/YOUR_PROJECT/YOUR_REPO.git also worked for me, thank you!! I will Answer this thread with my correct solution.
    – Rutrus
    Commented Nov 8, 2018 at 11:54
16

You can use the runners token for CI/CD Pipelines of your GitLab repo.

git clone https://gitlab-ci-token:<runners token>@git.example.com/myuser/myrepo.git

Where <runners token> can be obtained from:

git.example.com/myuser/myrepo/pipelines/settings

or by clicking on the Settings icon -> CI/CD Pipeline and look for Runners Token on the page

Screenshot of the runners token location: Screenshot of the runners token location

6
  • 5
    Note: The runners token has been deprecated now. Commented Sep 22, 2016 at 12:34
  • @ArihantGodha source?
    – miq
    Commented Sep 23, 2016 at 10:22
  • 2
    @miq see here (as of >= 8.12)
    – Yan Foto
    Commented Oct 21, 2016 at 11:19
  • 1
    This format is now deprecated, please see stackoverflow.com/questions/25409700/…
    – Muhan Alim
    Commented Nov 17, 2017 at 9:43
  • 2
    Doesn't work from inside GitLab CI pipeline. But this line works: git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/...
    – Slawa
    Commented Aug 30, 2018 at 13:47
15

Many answers above are close, but they get ~username syntax for deploy tokens incorrect. There are other types of tokens, but the deploy token is what gitlab offers (circa 2020+ at least) per repo to allow customized access, including read-only.

From a repository (or group), find the settings --> repository --> deploy tokens. Create a new one. A username and token field are created. The username is NOT a fixed value by default; it's unique to this token.

git clone https://<your_deploy_token_username>:<the_token>@gitlab.com/your/repo/path.git

Tested on gitlab.com public, free account.

14

Inside a GitLab CI pipeline the CI_JOB_TOKEN environment variable works for me:

git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/...

Source: Gitlab Docs

BTW, setting this variable in .gitlab-ci.yml helps to debug errors.

variables:
    CI_DEBUG_TRACE: "true"
13

One possible way is using a deploy token (https://docs.gitlab.com/ee/user/project/deploy_tokens). After creating the token, use:

git clone https://<username>:<deploy_token>@gitlab.example.com/tanuki/awesome_project.git 

as mentioned in the link above.

1
  • Neither does this seem to be working with npm install on a fresh docker container, defaults to ssh.
    – Vix
    Commented Apr 17, 2019 at 10:57
10

As of 8.12, cloning using HTTPS + runner token is not supported anymore, as mentioned here:

In 8.12 we improved build permissions. Being able to clone project using runners token it is no supported from now on (it was actually working by coincidence and was never a fully fledged feature, so we changed that in 8.12). You should use build token instead.

This is widely documented here - https://docs.gitlab.com/ce/user/project/new_ci_build_permissions_model.html.

4
  • 1
    It isn't possible using runners tokens but is using personal access tokens. Please see my answer: stackoverflow.com/questions/25409700/…
    – Muhan Alim
    Commented Nov 17, 2017 at 9:42
  • @MuhanAlim I'd recommend no one to expose their whole account using access tokens. That's why they are called Private Access Tokens!
    – Yan Foto
    Commented Nov 17, 2017 at 11:09
  • The question doesn't mention anything about making the key public, only how to use the key in place of a username and password for cloning. But that it is a good point, I would not recommend anyone use the keys anywhere that is public.
    – Muhan Alim
    Commented Nov 17, 2017 at 11:45
  • 2
    automation script implies that the whole procedure is not running locally. Probably somewhere where others also have access to.
    – Yan Foto
    Commented Nov 17, 2017 at 15:19
7

These days (Oct 2020) you can use just the following

git clone $CI_REPOSITORY_URL

Which will expand to something like:

git clone https://gitlab-ci-token:[MASKED]@gitlab.com/gitlab-examples/ci-debug-trace.git

Where the "token" password is ephemeral token (it will be automatically revoked after a build is complete).

2
  • How does it know the repository URL that you want? Seems like this would only work in CI/CD for the current repo. Commented Feb 15, 2023 at 21:00
  • You're using an environment variable that is specific to your environment.
    – Jeter-work
    Commented Jun 18 at 20:33
6

To make my future me happy: RTFM - don't use the gitlab-ci-token at all, but the .netrc file.

There are a couple of important points:

  1. echo -e "machine gitlab.com\nlogin gitlab-ci-token\npassword ${CI_JOB_TOKEN}" > ~/.netrc
  2. Don't forget to replace "gitlab.com" by your URL!
  3. Don't try to be smart and create the .netrc file directly - gitlab will not replace the $CI_JOB_TOKEN within the file!
  4. Use https://gitlab.com/whatever/foobar.com - not ssh://git@foobar, not git+ssh://, not git+https://. You also don't need any CI-TOKEN stuff in the URL.
  5. Make sure you can git clone [url from step 4]

Background: I got

fatal: could not read Username for 'https://gitlab.mycompany.com': No such device or address

when I tried to make Ansible + Gitlab + Docker work as I imagine it. Now it works.

1
  • I really like this answer as it doesn't require changing the git repo URL in any way. This is super useful if you have an install script where it is difficult or unwanted to change the URLs. Commented Feb 3 at 17:06
4

In my case, I just provided the token instead the password (second input field).

enter image description here

I pushed a local repo for the first time from the command line.

From the scratch, these are the commands I entered (remember to move inside the repo's folder first).

$ git init

$ git status

$ git add .

$ git status

$ git commit -m 'Shinra Tensei.'

$ git push --set-upstream https://gitlab.com/userName/my-repo.git master

Then, the pop-up message you can see in the picture comes up. Provided USERNAME and TOKEN.

1
  • 1
    thank you so much, your answer helped me
    – whitesiroi
    Commented Nov 12, 2021 at 6:16
4

Using PAT (Personal Access Token):

https://pat:<your-token>@gitlab.com/<org>/<proj>
1
  • 1
    I couldn't find any documentation on this, but it works!
    – poof86
    Commented Jun 13, 2023 at 20:44
3

I went SSH using the per project deploy keys setting (read only)

1
  • Me too because I am using GIT_STRATEGY: none.
    – Aalex Gabi
    Commented Mar 22, 2018 at 8:59
2

One issue I had here was the Project Access Token in private repo will not work if you select "Guest" when creating the token. Using "Reporter" or any other solves the issue.

1

Most answers here work, however, I'd hesitate about having the Personal Access Token visible in my remote. Besides, the remote URL will likely need to be changed when the Personal Access Token expires. My solution is to create a custom credential helper in the local repository configuration as follows:

cd <REPOSITORY_DIRECTORY>
git config --local \
    credential.helper \
    '!f() { echo username=gitlab-ci-token; echo "password=$GITLAB_TOKEN"; };f'

This allows me to:

  • Not have the token visible in my remote URL
  • Maintain my GITLAB_TOKEN in my environment variables
  • Change it whenever I need without having to change all my repos when my token expires

I have this configuration set to --local because I only need this for a single repository but you can change it to --global too. Hope this is useful for someone

0

you can change your:

user:oauth2
password : <youraccesstoken>

example:

git clone https://oauth2:<token>@hahahehe.com/yourname/yourproject.git
0

It may help: In your gitlab-ci file: Add this on before script step

before_script:
  - git config --global credential.helper store
  - echo "https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}" >> ~/.git-credentials
  - chmod 600 ~/.git-credentials

Thanks

-3

Customising the URL is not needed. Just use a git configuration for gitlab tokens such as

git config --global gitlab.accesstoken {TOKEN_VALUE}

extended description here

4
  • This did not work for me and I also couldn't find documentation anywhere on a config option with this name Commented Nov 3, 2020 at 0:02
  • Have you read the article in the link? This variable is what gitlab will take from your git client to authenticate and you need a personal access token.
    – Bizmate
    Commented Nov 3, 2020 at 1:00
  • I did read the linked article. gitlab.accesstoken does not do anything and there is no documentation anywhere on GitLab referencing it Commented Nov 3, 2020 at 15:40
  • The article is about some php package called composer and how to use gitlab access tokens within it.
    – Jeter-work
    Commented Jun 18 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.