GitLab Pages access control

{{< details >}}

• Tier: Free, Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated

{{< /details >}}

{{< history >}}

• Group SAML SSO support for Pages introduced in GitLab 18.2 with a feature flag named ff_oauth_redirect_to_sso_login. Disabled by default.
• Group SAML SSO support for OAuth applications enabled on GitLab.com, GitLab Self-Managed and GitLab Dedicated in GitLab 18.3.
• Generally available in GitLab 18.5. Feature flag ff_oauth_redirect_to_sso_login removed.

{{< /history >}}

You can enable Pages access control on your project if your administrator has enabled the access control feature on your GitLab instance. When enabled, only authenticated members of your project (at least Guest) can access your website, by default:

<i class="fa-youtube-play" aria-hidden="true"></i> For a demonstration, see Pages access controls.

1. In the top bar, select Search or go to and find your project.

2. In the left sidebar, select Settings > General.

3. Expand Visibility, project features, permissions.

4. To enable the access control, toggle Pages. If you don't see the toggle button, that means it isn't enabled. Ask your administrator to enable it.

5. The Pages access control dropdown list allows you to set who can view pages hosted with GitLab Pages, depending on your project's visibility:

   • If your project is private:
     • Only project members: Only project members can browse the website.
     • Everyone: Everyone, both logged into and logged out of GitLab, can browse the website, no matter their project membership.
   • If your project is internal:
     • Only project members: Only project members can browse the website.
     • Everyone with access: Everyone logged into GitLab can browse the website, no matter their project membership. External users can access the website only if they have a membership in the project.
     • Everyone: Everyone, both logged into and logged out of GitLab, can browse the website, no matter their project membership.
   • If your project is public:
     • Only project members: Only project members can browse the website.
     • Everyone with access: Everyone, both logged into and logged out of GitLab, can browse the website, no matter their project membership.

6. Select Save changes. Your changes may not take effect immediately. GitLab Pages uses a caching mechanism for efficiency. Your changes may not take effect until that cache is invalidated, which usually takes less than a minute.

The next time someone tries to access your website and the access control is enabled, they're presented with a page to sign in to GitLab and verify they can access the website.

When SAML SSO is configured for the associated group and the access control is enabled, users must authenticate using SSO before accessing the website.

When public access is disabled at the instance or group level, projects lose the Everyone visibility level option and are restricted to project members or everyone with access, depending on the project's visibility setting.

Remove public access for group Pages

{{< history >}}

• Introduced in GitLab 17.9.

{{< /history >}}

Configure a setting for the group to remove the public visibility option for Pages. When enabled, all projects in the group and its subgroups lose the option to use the "Everyone" visibility level and are restricted to project members or everyone with access, depending on the project's visibility setting.

Prerequisites

• Public access to Pages must not be disabled for the instance.
• You must have the Owner role for the group.

To do this:

1. In the top bar, select Search or go to and find your group.
2. In the left sidebar, select Settings > General.
3. Expand Permissions and group features.
4. Under Pages public access, select the Remove public access checkbox.
5. Select Save changes.

GitLab Pages uses a cache for efficiency. Changes to access settings typically take effect in one minute when the cache updates.

Authenticate with an access token

{{< history >}}

• Introduced in GitLab 17.10.

{{< /history >}}

To authenticate against a restricted GitLab Pages site, you can provide the Authorization header with an access token.

Prerequisites:

• You must have one of the following access tokens with the read_api scope:
  • Personal access token
  • Project access token
  • Group access token
  • OAuth 2.0 token

For example, to use an access token with OAuth-compliant headers:

curl --header "Authorization: Bearer <your_access_token>" <published_pages_url>

For invalid or unauthorized access tokens, returns 404.

Terminating a Pages session

To sign out of your GitLab Pages website, revoke the application access token for GitLab Pages:

1. In the upper-right corner, select your avatar.
2. Select Edit profile.
3. In the left sidebar, select Access > Applications.
4. In the Authorized applications section, find the GitLab Pages entry, and select Revoke.