2020-06-09 11:08:05 -04:00
---
stage: Manage
2022-01-26 22:14:06 -05:00
group: Authentication and Authorization
2020-11-26 01:09:20 -05:00
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
2020-06-09 11:08:05 -04:00
type: howto
---
2021-01-28 07:09:54 -05:00
# Credentials inventory **(ULTIMATE SELF)**
2019-12-17 04:07:48 -05:00
2022-03-07 01:15:33 -05:00
> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/20912) in GitLab 12.6.
> - [Bot-created access tokens not displayed in personal access token list](https://gitlab.com/gitlab-org/gitlab/-/issues/351759) in GitLab 14.9.
2019-12-17 04:07:48 -05:00
2021-06-15 14:09:57 -04:00
GitLab administrators are responsible for the overall security of their instance. To assist, GitLab
provides a Credentials inventory to keep track of all the credentials that can be used to access
their self-managed instance.
2019-12-17 04:07:48 -05:00
2022-02-08 10:12:33 -05:00
Use Credentials inventory to see for your GitLab instance all:
- Personal access tokens (PAT).
- Project access tokens (GitLab 14.8 and later).
- SSH keys.
- GPG keys.
You can also [revoke ](#revoke-a-users-personal-access-token ) and [delete ](#delete-a-users-ssh-key ) and see:
2019-12-17 04:07:48 -05:00
- Who they belong to.
- Their access scope.
- Their usage pattern.
2020-07-03 11:09:13 -04:00
- When they expire. [Introduced ](https://gitlab.com/gitlab-org/gitlab/-/issues/214809 ) in GitLab 13.2.
- When they were revoked. [Introduced ](https://gitlab.com/gitlab-org/gitlab/-/issues/214809 ) in GitLab 13.2.
2019-12-17 04:07:48 -05:00
2021-06-15 14:09:57 -04:00
To access the Credentials inventory:
2021-08-26 05:11:15 -04:00
1. On the top bar, select **Menu > Admin** .
2021-06-15 14:09:57 -04:00
1. On the left sidebar, select **Credentials** .
2019-12-17 04:07:48 -05:00
2020-09-10 11:09:10 -04:00
## Revoke a user's personal access token
2020-10-15 11:08:45 -04:00
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/214811) in GitLab 13.4.
2020-09-10 11:09:10 -04:00
If you see a **Revoke** button, you can revoke that user's PAT. Whether you see a **Revoke** button depends on the token state, and if an expiration date has been set. For more information, see the following table:
2022-02-03 22:15:11 -05:00
| Token state | [Token expiration enforced? ](settings/account_and_limit_settings.md#allow-expired-personal-access-tokens-to-be-used-deprecated ) | Show Revoke button? | Comments |
2020-09-10 11:09:10 -04:00
|-------------|------------------------|--------------------|----------------------------------------------------------------------------|
| Active | Yes | Yes | Allows administrators to revoke the PAT, such as for a compromised account |
| Active | No | Yes | Allows administrators to revoke the PAT, such as for a compromised account |
2020-10-08 05:08:40 -04:00
| Expired | Yes | No | PAT expires automatically |
| Expired | No | Yes | The administrator may revoke the PAT to prevent indefinite use |
| Revoked | Yes | No | Not applicable; token is already revoked |
| Revoked | No | No | Not applicable; token is already revoked |
2020-10-15 11:08:45 -04:00
2020-11-06 16:08:57 -05:00
When a PAT is revoked from the credentials inventory, the instance notifies the user by email.
2022-03-13 20:08:04 -04:00
![Credentials inventory page - Personal access tokens ](img/credentials_inventory_personal_access_tokens_v14_9.png )
2022-02-08 10:12:33 -05:00
## Revoke a user's project access token
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/243833) in GitLab 14.8.
The **Revoke** button next to a project access token can be selected to revoke that particular project access token. This will both:
- Revoke the token project access token.
- Enqueue a background worker to delete the project bot user.
2022-03-13 20:08:04 -04:00
![Credentials inventory page - Project access tokens ](img/credentials_inventory_project_access_tokens_v14_9.png )
2020-10-15 11:08:45 -04:00
## Delete a user's SSH key
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/225248) in GitLab 13.5.
You can **Delete** a user's SSH key by navigating to the credentials inventory's SSH Keys tab.
2020-11-06 16:08:57 -05:00
The instance then notifies the user.
2020-10-15 11:08:45 -04:00
2022-03-13 20:08:04 -04:00
![Credentials inventory page - SSH keys ](img/credentials_inventory_ssh_keys_v14_9.png )
2021-03-10 10:09:11 -05:00
## Review existing GPG keys
> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/282429) in GitLab 13.10.
2021-04-22 05:09:45 -04:00
> - [Feature flag removed](https://gitlab.com/gitlab-org/gitlab/-/issues/292961) in GitLab 13.12.
2021-03-10 10:09:11 -05:00
2021-03-22 14:09:24 -04:00
You can view all existing GPG in your GitLab instance by navigating to the
2021-03-10 10:09:11 -05:00
credentials inventory GPG Keys tab, as well as the following properties:
- Who the GPG key belongs to.
- The ID of the GPG key.
- Whether the GPG key is [verified or unverified ](../project/repository/gpg_signed_commits/index.md )
2022-03-13 20:08:04 -04:00
![Credentials inventory page - GPG keys ](img/credentials_inventory_gpg_keys_v14_9.png )