2020-06-09 15:08:05 +00:00
---
stage: Manage
group: Access
2020-11-26 06:09:20 +00:00
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
2020-06-09 15:08:05 +00:00
type: howto
---
2021-01-28 12:09:54 +00:00
# Credentials inventory **(ULTIMATE SELF)**
2019-12-17 09:07:48 +00:00
2020-02-06 15:09:11 +00:00
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/20912) in GitLab 12.6.
2019-12-17 09:07:48 +00:00
2021-06-15 18:09:57 +00:00
GitLab administrators are responsible for the overall security of their instance. To assist, GitLab
provides a Credentials inventory to keep track of all the credentials that can be used to access
their self-managed instance.
2019-12-17 09:07:48 +00:00
2021-03-22 18:09:24 +00:00
Using Credentials inventory, you can see all the personal access tokens (PAT), SSH keys, and GPG keys
that exist in your GitLab instance. In addition, you can [revoke ](#revoke-a-users-personal-access-token )
2021-03-10 15:09:11 +00:00
and [delete ](#delete-a-users-ssh-key ) and see:
2019-12-17 09:07:48 +00:00
- Who they belong to.
- Their access scope.
- Their usage pattern.
2020-07-03 15:09:13 +00:00
- When they expire. [Introduced ](https://gitlab.com/gitlab-org/gitlab/-/issues/214809 ) in GitLab 13.2.
- When they were revoked. [Introduced ](https://gitlab.com/gitlab-org/gitlab/-/issues/214809 ) in GitLab 13.2.
2019-12-17 09:07:48 +00:00
2021-06-15 18:09:57 +00:00
To access the Credentials inventory:
1. On the top bar, select **Menu >** ** {admin}** **Admin** .
1. On the left sidebar, select **Credentials** .
2019-12-17 09:07:48 +00:00
The following is an example of the Credentials inventory page:
2021-03-10 15:09:11 +00:00
![Credentials inventory page ](img/credentials_inventory_v13_10.png )
2020-09-10 15:09:10 +00:00
## Revoke a user's personal access token
2020-10-15 15:08:45 +00:00
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/214811) in GitLab 13.4.
2020-09-10 15:09:10 +00:00
If you see a **Revoke** button, you can revoke that user's PAT. Whether you see a **Revoke** button depends on the token state, and if an expiration date has been set. For more information, see the following table:
2021-06-21 09:10:07 +00:00
| Token state | [Token expiration enforced? ](settings/account_and_limit_settings.md#allow-expired-personal-access-tokens-to-be-used ) | Show Revoke button? | Comments |
2020-09-10 15:09:10 +00:00
|-------------|------------------------|--------------------|----------------------------------------------------------------------------|
| Active | Yes | Yes | Allows administrators to revoke the PAT, such as for a compromised account |
| Active | No | Yes | Allows administrators to revoke the PAT, such as for a compromised account |
2020-10-08 09:08:40 +00:00
| Expired | Yes | No | PAT expires automatically |
| Expired | No | Yes | The administrator may revoke the PAT to prevent indefinite use |
| Revoked | Yes | No | Not applicable; token is already revoked |
| Revoked | No | No | Not applicable; token is already revoked |
2020-10-15 15:08:45 +00:00
2020-11-06 21:08:57 +00:00
When a PAT is revoked from the credentials inventory, the instance notifies the user by email.
2020-10-15 15:08:45 +00:00
## Delete a user's SSH key
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/225248) in GitLab 13.5.
You can **Delete** a user's SSH key by navigating to the credentials inventory's SSH Keys tab.
2020-11-06 21:08:57 +00:00
The instance then notifies the user.
2020-10-15 15:08:45 +00:00
![Credentials inventory page - SSH keys ](img/credentials_inventory_ssh_keys_v13_5.png )
2021-03-10 15:09:11 +00:00
## Review existing GPG keys
> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/282429) in GitLab 13.10.
2021-04-22 09:09:45 +00:00
> - [Feature flag removed](https://gitlab.com/gitlab-org/gitlab/-/issues/292961) in GitLab 13.12.
2021-03-10 15:09:11 +00:00
2021-03-22 18:09:24 +00:00
You can view all existing GPG in your GitLab instance by navigating to the
2021-03-10 15:09:11 +00:00
credentials inventory GPG Keys tab, as well as the following properties:
- Who the GPG key belongs to.
- The ID of the GPG key.
- Whether the GPG key is [verified or unverified ](../project/repository/gpg_signed_commits/index.md )
![Credentials inventory page - GPG keys ](img/credentials_inventory_gpg_keys_v13_10.png )