Recovering a GitLab Account

I lost access to the primary email address associated with my free GitLab account. I still knew the password, but GitLab’s sign-in flow would send a one-time code to that address. To make things worse, my existing personal access token had expired, so it could no longer authenticate API requests.

I did, however, still possess a private SSH key whose public key was registered with that account, so I used GitLab Shell to create a short-lived personal access token, and used that token with the GitLab API to add a new secondary email address. I then confirmed that address from its inbox, and asked GitLab to send the sign-in code to it.

The following is what worked for me, but do not run these commands blindly. Use them as reference and consult the official documentation.

# create a short-lived personal access token
ssh -T git@gitlab.com personal_access_token email-recovery api 1

# store the temporary token in a shell variable
export GITLAB_TOKEN="glpat-..."

# add the new email address as a secondary address
curl --fail-with-body --request POST \
     --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
     --data-urlencode 'email=user@example.com' \
     https://gitlab.com/api/v4/user/emails

At this point, the new address had been added but not yet verified. Once verified, I signed in again. This time, when GitLab asked for the emailed code, I selected Send a code to another address associated with this account, chose the newly confirmed address, and entered the six-digit code sent to it.

After reganing access to the web account, I immediately replaced the old email address with the new one and added a new backup address. The important lesson here is that a registered SSH private key may be capable of more than cloning and pushing repos: it may also be used to regain access to your otherwise lost account!

🏷️ web