---
name: "glab-deploy-token-create"
section: "1"
platform: "linux"
package: "glab"
version: "1.128.0-1"
release: "Arch Linux 2026-11-07"
platforms: ["linux"]
url: "https://carta.tech/man/glab-deploy-token-create"
---

# glab-deploy-token-create(1)

Create a deploy token.

## NAME

glab-deploy-token-create - Create a deploy token.

## SYNOPSIS

**glab deploy-token create  \[flags\]**

## DESCRIPTION

Create a deploy token for a project or a group.

The token value is printed only once, when the token is created, and cannot be retrieved later. Use **--output json** to capture it from a script.

A deploy token authenticates as a username and token pair, so both values from the output are needed to use it.

The token does not expire unless **--expires-at** is given.

Every token must be granted at least one scope with **--scope**. For the scopes you can grant, see https://docs.gitlab.com/user/project/deploy\_tokens/#scope.

## OPTIONS

**-E**, **--expires-at**=\
 	Expiry of the token, as YYYY-MM-DD (00:00 UTC) or an RFC 3339 timestamp. The token does not expire if omitted.

**-g**, **--group**=""\
 	Create a deploy token for a **group** instead of a project. Accepts a group ID or full path.

**--jq**=""\
 	Filter JSON output with a jq expression.

**-F**, **--output**="text"\
 	Format output as: text, json.

**-R**, **--repo**=""\
 	Select another repository. You can use either OWNER/REPO or GROUP/NAMESPACE/REPO. The full URL or Git URL is also accepted.

**-S**, **--scope**=\[\]\
 	Scope to grant the token. Multiple scopes can be comma-separated or specified by repeating the flag.

**--username**=""\
 	Username for the token. Defaults to 'gitlab+deploy-token-'.

## OPTIONS INHERITED FROM PARENT COMMANDS

**-h**, **--help**\[=false\]\
 	Show help for this command.

## EXAMPLE

```
# Create a read-only deploy token for the current project
glab deploy-token create ci-reader --scope read_repository
# Create a token that can also pull images from the container registry
glab deploy-token create ci-reader --scope read_repository --scope read_registry
# Create a token for a specific project, with a custom username
glab deploy-token create ci-reader --scope read_repository --username ci-reader --repo user/my-repo
# Create a token that is valid until the end of 2027
glab deploy-token create ci-reader --scope read_repository --expires-at 2028-01-01
# Create a group deploy token
glab deploy-token create ci-reader --scope read_repository --group group/sub-group
# Create the token that CI/CD jobs receive as CI_DEPLOY_USER and CI_DEPLOY_PASSWORD
glab deploy-token create gitlab-deploy-token --scope read_registry
# Create a token and print its username and value from a script
glab deploy-token create ci-reader --scope read_repository --output json --jq '"\(.username) \(.token)"'
```

## SEE ALSO

**[glab-deploy-token(1)](/man/glab-deploy-token/1.md)**