Cannot rotate token on exact date when new expiration hits system limit (error: 'Expiration date must be before ...')
Summary
When attempting to rotate a [personal/or group/or project] access token on [June 11, 2025], whose current expiration date is [June 13, 2025], GitLab UI throws the following error:
"Expiration date must be before 2026-06-11"
This happens even though the rotation is being performed two days before expiration, which should be perfectly valid. I would like to do this in advance and not at the very last moment when the token expires.
Steps to reproduce
- Create a personal/or project/or group access token with an expiration date in the future (e.g., June 13, 2026)
- Wait until June 11, 2026
- Click "Rotate" from the GitLab UI
- GitLab attempts to create a new token with a default expiration 365 days ahead (i.e., June 13, 2026)
- UI throws an error:
"Expiration date must be before 2026-06-11"
Example Project
It doesn't make sense because it requires a lot of preparation.
What is the current bug behavior?
An unclear error message is displayed, and the token rotation process fails, even though the rotation is attempted before the token's expiration. Upon investigation, it appears that the rotation function uses the token's expiration date as its reference point, rather than the date on which the rotation is initiated.
What is the expected correct behavior?
- The token expiration date should be determined either by executing the rotation function or by providing a form that allows manual input. By default, the manually specified date should not exceed 365 days from the current date.
- If an error occurs, a clearer and more informative message should be displayed, indicating the root cause (e.g., “Maximum expiration date exceeded”).
Relevant logs and/or screenshots
Workaround
Delete the existing token and generate a new one from scratch.
Output of checks
This bug happens on GitLab version: v17.8.6-ee, don't know if the same behavior was on other versions.