Secrets Manager API

Use this API to access GitLab Secrets Manager secrets from non-CI/CD workloads.

The API mints a short-lived JSON web token (JWT) for a project or group. A client presents this token to the OpenBao backend to read secrets directly, the same way GitLab Runner reads secrets during a CI/CD job. The response includes the OpenBao connection details the client needs.

You call this API with a personal access token, project or group access token, or service account token that has the api scope. The token the API returns is a separate, short-lived OpenBao JWT, not a GitLab access token. It expires after five minutes. Reading a secret value also requires the principal to have the read value permission for that secret.

To use the returned connection details to read a secret, see Access secrets from non-CI/CD workloads.

Create a Secrets Manager access token for a project

Mints an access token for reading a project’s secrets.

POST /projects/:id/secrets_manager/access_token

Supported attributes:

Example request:

curl --request POST \
  --header "PRIVATE-TOKEN: <your_access_token>" \
  --url "https://gitlab.example.com/api/v4/projects/1/secrets_manager/access_token"

Example response:

{
  "expires_at": "2026-05-27T10:35:00Z",