Skip to content

glab token rotate: add option to update config file

When rotating a personal access token with glab token rotate --user @me (or your own user), the old one is revoked, which means that unless you manually store the new one in your config file, your glab based access will no longer work, until you manually login to the website and create a new token.

The token is printed to the terminal by default, which could be visible to other people or to cameras.

The easiest way to store the token for further use is glab config set token glpat-SECRET, but that leaks the token to the process tree on multi-user systems, and leaks the token to the shell history, which could be synced elsewhere etc.

All glab token sub-commands could add to the --output option a parameter option save, which would cause them to save the tokens into glab secret storage, and then print a message about that.

When stdout is a terminal, the glab token rotate --user @me (or your own user) command could check if the ID of the auth token is the same as the ID of the token being rotated and when it is then automatically switch the --output option to save.

When stdout is a terminal, the glab token revoke --user @me (or your own user) command could check if the ID of the auth token is the same as the ID of the token being revoked and when it is then output an error, or automatically switch to the rotate command and print a message about that.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information