glab(1)

NAME
glab-token-rotate - Rotate user, group, or project access tokens.

SYNOPSIS
glab token rotate [flags]

DESCRIPTION
If multiple tokens share the same name, specify the token ID to select the correct one.

The token expires at 00:00 UTC on a date calculated by adding the duration to today's date. The default duration is 30 days. You can specify a different duration in days (d), weeks (w), or hours (h). The --duration and --expires-at flags are mutually exclusive.

Administrators can rotate personal access tokens that belong to other users.

OPTIONS
-D, --duration=30d
    Sets the token lifetime in days. Accepts: days (30d), weeks (4w), or hours in multiples of 24 (24h, 168h, 720h). Maximum: 365d. The token expires at 00:00 UTC on the calculated date.

-E, --expires-at=0001-01-01
    Sets the token's expiration date and time, in YYYY-MM-DD format. If not specified, --duration is used.

-g, --group=""
    Rotate group access token. Ignored if a user or repository argument is set.

-F, --output="text"
    Format output as: text, json. 'text' provides the new token value; 'json' outputs the token with metadata.

-R, --repo=""
    Select another repository. Can use either OWNER/REPO or GROUP/NAMESPACE/REPO format. Also accepts full URL or Git URL.

-U, --user=""
    Rotate personal access token. Use @me for the current user.

OPTIONS INHERITED FROM PARENT COMMANDS
-h, --help[=false]
    Show help for this command.

EXAMPLE
    # Rotate project access token of current project (default 30 days)
    glab token rotate my-project-token
    # Rotate project access token with explicit expiration date
    glab token rotate --repo user/repo my-project-token --expires-at 2025-08-08
    # Rotate group access token with 7 day lifetime
    glab token rotate --group group/sub-group my-group-token --duration 7d
    # Rotate personal access token with 2 week lifetime
    glab token rotate --user @me my-personal-token --duration 2w
    # Rotate a personal access token of another user (administrator only)
    glab token rotate --user johndoe johns-personal-token --duration 90d

SEE ALSO
glab-token(1)