Get gitlab-ci token with gitlab API

Question

It's unclear from the API how to get the token that can be used to clone http repositories.

From the documentation here:

http://doc.gitlab.com/ee/ci/api/README.html

It should be possible to GET this url:

http://gitlab.com/ci/api/v1/projects?private_token=QVy1PB7sTxfy4pqfZM1U&url=http://demo.gitlab.com/

I'm not sure where the url parameter is taken from but even with just my private token, it receive a 404 error page.

I tried with the ci subdomain but it simply redirect me to gitlab.com.

That said, I'll explain a bit more the reason why I need that. I have a server that could have multiple projects. Each projects will contain a list of repositories private/public each project has to be cloned/pulled and whatever regularly. Unlike github, gitlab doesn't provide a oauth2 token that is sitewide and instead provide a CI-token for each project. I could make sure that the user enter the token for each project but that is way more complicated than entering the private token.

On the other hand, I could generate SSH keys for each users and add the public key to their account and this way it would be possible to fetch/clone with ssh instead of http. But that is a bit more work on my end than just fetching a token and cloning with a basic auth url

git clone https://gitlab-ci-token:[email protected]/project.git

Answer 1

You can find the token by doing the following from gitlab.com

1. Click on the project you are working on from the starting screen
2. Click "Settings" on the left hand navigation
3. Scroll down to the bottom and click "CI / CD" which is nested in Settings
4. Under the "Runners" section click expand
5. Token is hidden here.

Took me 10 minutes to find this... not documented anywhere.

Answer 2

According to new Gitlab CI Build Permissions Model, HTTPS is now a requirement to clone all the sources. So that rules out the SSH option.

Now to clone any private repo you can just do:

git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/<group_name>/<repo>.git

Also, you DONT need to specify the value for CI_JOB_TOKEN. It is taken automatically. So, just fill in the <group_name> and <repo>.

Also, remember that gitlab.com can be replaced by gitlab.xyz.cloud (your private gitlab enterprise) and this will still work.

Needless to say that you would never actually require the value of CI_JOB_TOKEN