> ## Documentation Index
> Fetch the complete documentation index at: https://docs.expira.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# GitLab

> Connect GitLab.com or a self-managed GitLab instance to Expira to track personal access, deploy, runner, trigger and agent token expiry.

Expira scans a GitLab instance and tracks the expiry of the tokens it can see. Daily syncs run at 09:00 UTC.

## What Expira finds

| Token type | Notes |
| - | - |
| Personal access tokens | Your own tokens. With an admin token, every user's tokens, including impersonation tokens. |
| Deploy tokens | Instance-wide with an admin token, otherwise per project. |
| Runners | Runner token expiry, up to 200 runners. |
| Pipeline trigger tokens | Per project. |
| Cluster agent tokens | Per project. |

Revoked tokens are removed. Tokens that expired more than 30 days ago are dropped.

## Create a token

Create a personal access token in GitLab with the **`read_api`** scope and an expiry date.

To list **every user's** tokens on a self-managed instance, use an administrator's token and add the **`admin_mode`** scope.

## Add the connection in Expira

**1. Open the form**

Go to **Integrations → GitLab → Add connection**.

**2. Fill in the details**

* **Display name**, for example "GitLab.com" or "Internal GitLab".
* **GitLab URL**: `https://gitlab.com`, or your instance such as `https://gitlab.example.com`.
* **Personal Access Token** (starts with `glpat-`).

**3. Choose the projects**

* **All projects I have access to** scans every project the token is a member of.
* **Specific projects** scans only the project IDs you list, comma-separated, such as `123, 456`. The project ID is on the project's main page, below its name.

**4. Sync**

Save, then press **Sync**.

## Self-managed GitLab

The URL must use `https` and be reachable from the public internet. Expira first checks the token with `GET /user`; an instance that only resolves on a VPN, or through a local hosts file, fails with one clear error instead of a list of failures. See [Troubleshooting](https://docs.expira.dev/integrations/troubleshooting.md#host-not-reachable).

## When the token expires

If GitLab rejects the token, the sync fails with: "GitLab rejected the access token (HTTP 401) — it is invalid, expired or revoked. Update the token on this integration." Paste a new token into the connection's **Edit** form.

Expira tracks the connected token's own expiry too, so you'll be reminded before it lapses.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.