### Checklist - [x] I'm using the latest version of the extension (Run `glab --version`) - Extension version: glab 1.89.0 (c6fca530) - [x] Operating system and version: macOS 26.3.1 (25D2128) - [x] Gitlab.com or self-managed instance? gitlab.com - [x] GitLab version (if self-managed): N/A - [x] I have performed `glab auth status` to check for authentication issues - [x] Run the command in debug mode (like `DEBUG=true glab mr list`) and attach any useful output (by the time I got here to report the issue, it had been locally remediated via strange workaround, so it doesn't make sense to run with DEBUG now). ### Summary I want my agentic assistant's actions in GitLab to be attributed to an SA, and I want my actions to be attributed to me. Using SA's PAT as the value of GITLAB_TOKEN in the MCP server's environment seemed to be the trick; however, when my personal (not SA's PAT) oauth token expired, the MCP suddenly started failing: - I had been running `glab mcp serve` with my SA's PAT provided via GITLAB_TOKEN successfully for about a week; that suddenly started reporting oauth error responses to my agent's MCP activations - while I was interested ONLY in finding the cause of MCP failure with SA's PAT, I purposely disregarded refreshing my personal oauth (web) credential; that "couldn't affect problem" because `glab` documentation states, in the presence of GITLAB_TOKEN, that will be used to authorize all requests - since Duo's troubleshooting step requested it, I went ahead and `glab auth login` without a GITLAB_TOKEN environment var (refreshing my own oauth token via the web interface) - immediately after, `glab` commands that had been failing when using GITLAB_TOKEN with my SA's PAT began working; the only difference between (before: failing) and (after: working) is that in-between, I also refreshed my personal oauth credential. Witness: ``` sh4m1l65@Tommys-Mac-Studio swiftly-sparkling-salamander % GITLAB_TOKEN=glpat-XYZ glab auth status gitlab.com x gitlab.com: API call failed: oauth2: "invalid_grant" "The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client." ✓ Git operations for gitlab.com configured to use https protocol. ✓ API calls for gitlab.com are made over https protocol. ✓ REST API Endpoint: https://gitlab.com/api/v4/ ✓ GraphQL Endpoint: https://gitlab.com/api/graphql/ ✓ Token found: ************************** ! One of GITLAB_TOKEN, GITLAB_ACCESS_TOKEN, OAUTH_TOKEN environment variables is set. It will be used for all authentication. ERROR could not authenticate to one or more of the configured GitLab instances.. sh4m1l65@Tommys-Mac-Studio swiftly-sparkling-salamander % glab auth status gitlab.com x gitlab.com: API call failed: oauth2: "invalid_grant" "The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client." ✓ Git operations for gitlab.com configured to use https protocol. ✓ API calls for gitlab.com are made over https protocol. ✓ REST API Endpoint: https://gitlab.com/api/v4/ ✓ GraphQL Endpoint: https://gitlab.com/api/graphql/ ✓ Token found: ************************** ERROR could not authenticate to one or more of the configured GitLab instances.. sh4m1l65@Tommys-Mac-Studio swiftly-sparkling-salamander % glab auth login - Signing into gitlab.com - glab config set -h gitlab.com git_protocol ssh ✓ Configured Git protocol. - glab config set -h gitlab.com api_protocol https ✓ Configured API protocol. ✓ Logged in as sh4m1l65 ✓ Configuration saved to /Users/sh4m1l65/.config/glab-cli/config.yml - Host: gitlab.com sh4m1l65@Tommys-Mac-Studio swiftly-sparkling-salamander % glab auth status gitlab.com ✓ Logged in to gitlab.com as sh4m1l65 (/Users/sh4m1l65/.config/glab-cli/config.yml) ✓ Git operations for gitlab.com configured to use ssh protocol. ✓ API calls for gitlab.com are made over https protocol. ✓ REST API Endpoint: https://gitlab.com/api/v4/ ✓ GraphQL Endpoint: https://gitlab.com/api/graphql/ ✓ Token found: ************************** sh4m1l65@Tommys-Mac-Studio swiftly-sparkling-salamander % GITLAB_TOKEN=glpat-XYZ glab api /user { "id": 30047260, "username": "s3cr3t-agent", "public_email": null, "name": "AI Agent", "state": "active", "locked": false, "avatar_url": "https://secure.gravatar.com/avatar/85b3c69705e45647727bec6edb1c365e85d1935c6cb280400a03578ead393ebf?s=80\u0026d=identicon", "web_url": "https://gitlab.com/s3cr3t-agent", "created_at": "2025-09-03T16:57:19.872Z", "bio": "", "location": "", "linkedin": "", "twitter": "", "discord": "", "website_url": "", "github": "", "job_title": "", "pronouns": null, "organization": "", "bot": true, "work_information": null, "local_time": null, "last_sign_in_at": null, "confirmed_at": "2025-11-05T17:26:51.944Z", "last_activity_on": "2026-03-10", "email": "sh4m1l65+agent@s3cr3t.codes", "theme_id": 3, "color_scheme_id": 1, "projects_limit": 0, "current_sign_in_at": null, "identities": [], "can_create_group": false, "can_create_project": false, "two_factor_enabled": false, "external": true, "private_profile": false, "commit_email": "sh4m1l65+agent@s3cr3t.codes", "preferred_language": "en", "shared_runners_minutes_limit": null, "extra_shared_runners_minutes_limit": null, "scim_identities": [] } sh4m1l65@Tommys-Mac-Studio swiftly-sparkling-salamander % GITLAB_TOKEN=glpat-XYZ glab auth status gitlab.com ✓ Logged in to gitlab.com as s3cr3t-agent (GITLAB_TOKEN) ✓ Git operations for gitlab.com configured to use ssh protocol. ✓ API calls for gitlab.com are made over https protocol. ✓ REST API Endpoint: https://gitlab.com/api/v4/ ✓ GraphQL Endpoint: https://gitlab.com/api/graphql/ ✓ Token found: ************************** ! One of GITLAB_TOKEN, GITLAB_ACCESS_TOKEN, OAUTH_TOKEN environment variables is set. It will be used for all authentication. ``` ### Environment - OS: Darwin 25.3.0 arm64 - SHELL: /bin/zsh - TERM: tmux-256color - GLAB: glab 1.89.0 (c6fca530) Other: (nothing further seems relevant) ### Steps to reproduce 1. generate a PAT for SA with sufficient scopes (api, write_repository, read_repository) 2. test the PAT with something like `GITLAB_TOKEN=glpat-XYZ glab api /user` with the PAT value set in the GITLAB_TOKEN environment 3. WAIT FOR EXPIRATION OF PERSONAL (not SA) OAUTH TOKEN (`glab auth logout` is insufficient to trigger) 4. witness `glab` commands begin failing when using SA's PAT (GITLAB_TOKEN) > x gitlab.com: API call failed: oauth2: "invalid_grant" "The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client." 5. refresh PERSONAL oauth token `glab auth login` 6. witness non-failure of glab commands using GITLAB_TOKEN=glpat_XYZ ### What is the current _bug_ behavior? while personal oauth is invalid/expired, commands using SA's PAT fail ### What is the expected _correct_ behavior? no correlation whatsoever between auth state of non-SA oauth token and correct functioning of glab commands using the SA's PAT ### Relevant logs and/or screenshots (see transcript above) ### Possible fixes (none offered)