Update/Unexpire expired Gitlab Access Tokens for Users and Projects

update_gitlab_token_expiry.md

GitLab Rails Console: Unexpire Access Tokens

These commands can be used from the GitLab Rails console to extend the expiration date of access tokens.

⚠️ Warning: These commands modify token expiration dates directly in the GitLab database. Use them carefully, especially in production environments. Consider backing up your database and verifying the affected tokens before running update_all.

User Access Tokens

To extend the expiration date of all personal access tokens belonging to a specific user:

User.find_by_username('username').personal_access_tokens.update_all(
  expires_at: 10.years.from_now
)

This sets the expiration date of all personal access tokens belonging to username to 10 years from now.

Project Access Tokens

Project access tokens are associated with project bot users. To extend the expiration date of all project access tokens belonging to a specific project:

PersonalAccessToken
  .where(user_id: Project.find_by_full_path('group/project').bots.select(:id))
  .update_all(expires_at: 10.years.from_now)

Replace group/project with the full path of the desired project.

Verify Before Updating

Before modifying the tokens, you can inspect which records will be affected:

User tokens

User.find_by_username('username').personal_access_tokens
  .pluck(:id, :name, :expires_at, :revoked)

Project tokens

project = Project.find_by_full_path('group/project')

PersonalAccessToken
  .where(user_id: project.bots.select(:id))
  .pluck(:id, :name, :expires_at, :revoked)

These commands only modify expires_at; they do not change the token value itself.

Note: GitLab's internal Rails models and database schema can change between GitLab releases. Test the commands against your specific GitLab version before using them in production.