1. Run

   glab auth login

2. Choose authentication method (token or browser)
3. Follow prompts for your GitLab instance
4. Verify with

   glab auth status

glab auth login

supports a complete setup flow:

• --api-host

  to explicitly set a different API/Web endpoint for self-hosted instances

• --ssh-hostname

  to explicitly set a different SSH endpoint for self-hosted instances

• --web

  to skip the login-type prompt and go straight to browser/OAuth auth

• --container-registry-domains

  to preconfigure registry / dependency-proxy domains during login

Example: API hostname

gitlab.company.com

, SSH hostname

ssh.company.com

api

write_repository

https://<host>/-/user_settings/personal_access_tokens/legacy/new?scopes=api,write_repository

https://<host>/-/user_settings/personal_access_tokens?scopes=api,write_repository

--hostname

GITLAB_HOST

host

gitlab.com

--hostname

GITLAB_HOST

GITLAB_API_HOST

GITLAB_SSH_HOST

--hostname

GITLAB_HOST

--api-host

--ssh-hostname

GLAB_CONTAINER_REGISTRY_DOMAINS

GLAB_GIT_PROTOCOL

GLAB_API_PROTOCOL

Confidential: off

client_id

glab config set client_id <client_id> -g --host <hostname>

GITLAB_CLIENT_ID

glab config set client_id <client_id> -g --host <hostname>

GITLAB_CLIENT_ID

Keep these env files outside version control, restrict their permissions (for example `chmod 600`), be mindful of backup exposure, and prefer least-privilege bot/service-account tokens. In a reused shell, clear stale GitLab auth vars first or start a fresh shell.

If the file uses plain `KEY=value` lines, load it with exported vars before running `glab`:

```bash
unset GITLAB_TOKEN GITLAB_ACCESS_TOKEN OAUTH_TOKEN GITLAB_HOST
set -a
source ~/.config/openclaw/env/gitlab-<actor>.env
set +a

• plain

  source

  does not necessarily export variables to child processes

• glab

  only sees env vars that are exported
• if

  glab

  cannot see the env token, it may silently fall back to shared stored auth in the active global config file
• if another env file was sourced earlier in the same shell/session, identity can be sticky in ways that are unsafe for writes unless you deliberately switch and verify

1. Stop posting.
2. Delete the mistaken comment or reply if cleanup is needed.

3. unset GITLAB_TOKEN GITLAB_ACCESS_TOKEN OAUTH_TOKEN GITLAB_HOST

   or start a fresh shell.
4. Source the correct env file with

   set -a; source ...; set +a

   .
5. Rerun

   glab auth status --hostname "$GITLAB_HOST"

   and

   glab api --hostname "$GITLAB_HOST" user

   .
6. Repost under the correct actor.
7. Verify the thread no longer shows the wrong visible author for the replacement message.

glab api --hostname "$GITLAB_HOST"

1. Logout from current:
   bash

   glab auth logout

2. Login to new instance:
   bash

   glab auth login --hostname gitlab.company.com

3. Verify:
   bash

   glab auth status --hostname gitlab.company.com

1. Configure Docker helper:
   bash

   glab auth configure-docker

2. Verify Docker can authenticate:
   bash

   docker login registry.gitlab.com

3. Pull private images:
   bash

   docker pull registry.gitlab.com/group/project/image:tag

configure-docker

docker login

docker logout <domain>

${DOCKER_CONFIG:-$HOME/.docker}/config.json

~/.local/bin

PATH

PATH

• Check status:

  glab auth status

• Verify token hasn't expired (check GitLab settings)
• Re-authenticate:

  glab auth login

• If you switched from browser/OAuth login to token-based login and

  glab

  still appears to use stale stored credentials, run

  glab auth login

  again instead of assuming the config must be edited manually.
• After re-login, verify with

  glab auth status

  before retrying the failing command.

• If

  GITLAB_TOKEN

  ,

  GITLAB_ACCESS_TOKEN

  , or

  OAUTH_TOKEN

  is exported, it overrides stored credentials only for trusted hosts (see above).

• GITLAB_TOKEN

  and

  GITLAB_ACCESS_TOKEN

  are treated as personal access tokens independently of a stored OAuth profile, so a temporary PAT does not inherit or refresh saved OAuth state.
• If the host is configured for OAuth but an environment variable contains an OAuth access token, set

  GLAB_IS_OAUTH2=true

  ; otherwise glab sends the environment token as a personal access token.

  glab auth status

  reports this scheme mismatch after a 401.
• If auth suddenly fails, check whether an env token is being picked up before assuming your saved login is broken.

  glab auth login

  and

  glab auth status

  warn when this precedence applies.
• Run

  type glab

  to distinguish a wrapper that intentionally injects a token (for example, a 1Password shell plugin alias) from a plain executable path. A wrapper can be expected and need no action; a plain path means the token came from the shell profile, current environment, or CI variables.
• These failures can affect both read operations and writes, not just write pre-flight checks.
• Verify the active actor and token path with

  glab auth status

  and

  glab api user

  before any GitLab write.
• In multi-agent shells, deliberately re-source the intended env file with

  set -a; source ...; set +a

  before retrying.

• Re-authenticate with the full configured host/subfolder; browser OAuth includes the configured subfolder in its authorization URL.
• OAuth token refresh also uses the configured subfolder; verify

  glab config get subfolder --host <host>

  before assuming the token endpoint is at the host root.
• A stored OAuth token inside the five-minute expiry grace period is proactively refreshed when credentials can be saved.
• A re-authentication response that omits a replacement refresh token preserves the existing refresh token instead of clearing it.
• If refresh fails with

  invalid_grant

  , re-run

  glab auth login

  ; a revoked/expired OAuth grant or an earlier failed credential save can leave stored OAuth credentials stale.
• If OAuth refresh fails inside a sandbox with a credential-save error, grant write access to

  glab config path --dir

  and re-authenticate. Retrying the same stale token normally will not repair the saved credential.
• Docker and other helpers skip OAuth refresh for hosts authenticated with personal access tokens; check the token type before debugging OAuth state.

• Use

  --hostname

  flag to specify instance
• Each instance maintains separate auth

• Re-run:

  glab auth configure-docker

• Check only the intended registry's helper with the read-only diagnostic below (requires Python 3 and a Bash-compatible shell). Replace

  registry.gitlab.com

  with one non-empty exact registry key. It respects

  DOCKER_CONFIG

  , falling back to

  $HOME/.docker

  when unset or empty. Never print the full config: it can contain credentials for unrelated registries.
• If Python 3 or a compatible shell is unavailable (including PowerShell/cmd-only hosts), stop this optional diagnostic. Do not fall back to displaying the file, a raw selected value, or credential-helper output. Ask the operator to inspect the selected registry privately and report only

  glab-cli

  ,

  glab

  ,

  not configured

  , or

  different helper configured

  . Do not install tools or change configuration merely to run this check without operator approval.

python3 - registry.gitlab.com <<'PY'
import json
import os
import sys
from pathlib import Path

if len(sys.argv) != 2 or not sys.argv[1]:
    sys.exit("Usage: pass one registry key.")

config_dir = os.environ.get("DOCKER_CONFIG") or str(Path.home() / ".docker")
try:
    with (Path(config_dir) / "config.json").open(encoding="utf-8") as config_file:
        contents = config_file.read()
        config = json.loads(contents) if contents.strip(" \t\r\n") else {}
    if not isinstance(config, dict):
        raise ValueError
    helpers = config.get("credHelpers")
    if helpers is None:
        helpers = {}
    if not isinstance(helpers, dict):
        raise ValueError
    helper = helpers.get(sys.argv[1], "")
    if helper is None:
        helper = ""
    if not isinstance(helper, str):
        raise ValueError
except FileNotFoundError:
    sys.exit("Docker config is missing.")
except (OSError, ValueError, RecursionError):
    # Do not include exception details: they can contain config data or paths.
    sys.exit("Docker config is unreadable or invalid.")
if helper == "glab-cli":
    print("Selected registry credential helper: glab-cli")
elif helper == "glab":
    print("Selected registry credential helper: glab")
elif not helper:
    print("Selected registry credential helper: not configured")
else:
    print("Selected registry credential helper: different helper configured")
PY

glab-cli

glab

glab

glab-artifact-registry

credHelpers

not configured

auths

• login

  - Authenticate with GitLab instance

• logout

  - Log out of GitLab instance

• status

  - View authentication status

• configure-docker

  - Configure Docker to use GitLab registry

• docker-helper

  - Docker credential helper

• dpop-gen

  - Generate DPoP token

• After authentication, see

  glab-config

  to set CLI defaults
• See

  glab-ssh-key

  for SSH key management
• See

  glab-gpg-key

  for commit signing setup

• See

  glab-repo

  for cloning repositories
• Authentication required before first clone/push