Members & Roles

Mon, 01 Jan 0001 00:00:00 +0000

GitLab uses a role-based access model to control what members can see and do within a group or project. Each member is assigned a role that defines their permissions.

Roles Overview

GitLab defines five base roles, from the most restricted to the most privileged:

Role	Typical permissions
Guest	View issues and epics, create issues (project members only)
Reporter	Everything Guest can do, plus manage issues, labels, and milestones
Developer	Everything Reporter can do, plus push code, create MRs, manage branches
Maintainer	Everything Developer can do, plus manage project settings and members
Owner	Full control, including group/project deletion (group level)

Note

GitLab Ultimate also supports custom roles : roles built on top of a base role with additional granular permissions (e.g., a Guest who can also read code). Custom roles are configured at the instance level by a GitLab administrator.

Secrets

Mon, 01 Jan 0001 00:00:00 +0000

This document lists all secrets, tokens and credentials that can be configured and managed by a non-administrator user in GitLab.

For each item, a concise explanation of its usage and a link to the official documentation are provided.

Quick Selection Guide

Choose the appropriate credential type based on your needs:

Your Need	Recommended Credential
Tokens
Personal development via HTTPS	Personal Access Tokens
Automated access to one project	Project Access Tokens
Automated access across a group/subgroup	Group Access Tokens
Deploy/pull code in production	Deploy Tokens
Access GitLab within pipeline jobs	CI/CD Job Tokens
Keys
Personal development via SSH	SSH Keys
SSH access from external servers	Deploy Keys
CI/CD Variables
Store credentials in pipelines	CI/CD Variables (masked)

Important

Use descriptive names and/or descriptions
Create a new key/token for each use case—don’t reuse tokens across multiple places
Preserve auditability: Individual secret with clear purposes allows you to track usage and quickly identify which secret can be revoked or rotated if needed.

Tokens

Software Factory Recommendations

Define an expiration date according to your operational needs
Select only necessary permissions (use read_repository instead of api when possible)
Use the rotation feature (self_rotate) if available

Personal Access Tokens (PATs)

Personal access tokens serve as authentication credentials that function as password substitutes.

Manage on Software Factory

Members & Roles

Roles Overview

Secrets

Quick Selection Guide

Tokens

Personal Access Tokens (PATs)