glab-deploy-key

name	glab-deploy-key
description	Manage GitLab deploy keys using the glab CLI. Use this skill whenever the user wants to add, list, view, or delete deploy keys for a GitLab project. Trigger on phrases like "add a deploy key", "set up read-only SSH access for CI", "list deploy keys", "remove a deploy key", or any GitLab deploy key management task.

GitLab Deploy Key Management

Use glab deploy-key to manage project-scoped SSH keys for deployment automation. Deploy keys are project-specific (unlike account SSH keys) and are ideal for CI/CD systems and servers that need repository access.

Add a Deploy Key

glab deploy-key add -t "<title>" <public-key-file>

# Read-only access (default)
glab deploy-key add -t "ci-server" ~/.ssh/deploy_id_ed25519.pub

# Read-write access (allows push)
glab deploy-key add -t "deploy-agent" ~/.ssh/deploy_id_ed25519.pub -c

# With expiry
glab deploy-key add -t "temp-key" ~/.ssh/deploy.pub -e 2025-12-31

Key flags:

• -t / --title display name (required)
• Positional argument: path to the public key file (.pub)
• -c / --can-push allow push access (default: read-only)
• -e / --expires-at ISO 8601 expiry date

List Deploy Keys

glab deploy-key list

Get a Deploy Key

glab deploy-key get <id>

Delete a Deploy Key

glab deploy-key delete <id>

Deploy Key vs Account SSH Key

	Deploy Key	Account SSH Key
Scope	Single project	All projects you own
Linked to	Project	User account
Best for	CI/CD servers	Developer machines
Read-write	Optional (-c)	Full access

Typical Workflow

# 1. Generate a dedicated key for the deploy target
ssh-keygen -t ed25519 -f ~/.ssh/deploy_project_name -N ""

# 2. Add the public key as a deploy key (read-only)
glab deploy-key add -t "prod-server-2025" ~/.ssh/deploy_project_name.pub

# 3. Configure SSH on the target machine to use this key
# ~/.ssh/config:
# Host gitlab.com
#   IdentityFile ~/.ssh/deploy_project_name

Behavior Guidelines

1. Dedicated keys: Always generate a separate key pair for each deploy target — never reuse personal SSH keys as deploy keys.
2. Read-only by default: Only add -c (can-push) if the deployment process needs to push commits or tags back to the repository.
3. Expiry: Recommend setting expiry dates for deploy keys used in temporary environments.
4. Key naming: Use descriptive titles like prod-server, ci-runner-01 to track where each key is deployed.