| name | glab-deploy-key |
| description | Manage GitLab deploy keys using the glab CLI. Use this skill whenever the user wants to add, list, view, or delete deploy keys for a GitLab project. Trigger on phrases like "add a deploy key", "set up read-only SSH access for CI", "list deploy keys", "remove a deploy key", or any GitLab deploy key management task. |
GitLab Deploy Key Management
Use glab deploy-key to manage project-scoped SSH keys for deployment automation. Deploy keys are project-specific (unlike account SSH keys) and are ideal for CI/CD systems and servers that need repository access.
Add a Deploy Key
glab deploy-key add -t "<title>" <public-key-file>
glab deploy-key add -t "ci-server" ~/.ssh/deploy_id_ed25519.pub
glab deploy-key add -t "deploy-agent" ~/.ssh/deploy_id_ed25519.pub -c
glab deploy-key add -t "temp-key" ~/.ssh/deploy.pub -e 2025-12-31
Key flags:
-t / --title display name (required)
- Positional argument: path to the public key file (
.pub)
-c / --can-push allow push access (default: read-only)
-e / --expires-at ISO 8601 expiry date
List Deploy Keys
glab deploy-key list
Get a Deploy Key
glab deploy-key get <id>
Delete a Deploy Key
glab deploy-key delete <id>
Deploy Key vs Account SSH Key
| Deploy Key | Account SSH Key |
|---|
| Scope | Single project | All projects you own |
| Linked to | Project | User account |
| Best for | CI/CD servers | Developer machines |
| Read-write | Optional (-c) | Full access |
Typical Workflow
ssh-keygen -t ed25519 -f ~/.ssh/deploy_project_name -N ""
glab deploy-key add -t "prod-server-2025" ~/.ssh/deploy_project_name.pub
Behavior Guidelines
- Dedicated keys: Always generate a separate key pair for each deploy target — never reuse personal SSH keys as deploy keys.
- Read-only by default: Only add
-c (can-push) if the deployment process needs to push commits or tags back to the repository.
- Expiry: Recommend setting expiry dates for deploy keys used in temporary environments.
- Key naming: Use descriptive titles like
prod-server, ci-runner-01 to track where each key is deployed.