[SOLVED] How to download a private repository from Gitlab without exposing the access token in the url?

Issue

I want to download a private repository from Gitlab using curl command (unfortunately I am obliged to do so). I know that the following works:

curl 'https://gitlab.com/api/v4/projects/2222/repository/archive?private_token=hlpat-21321' > your_project.tar.gz

where 21321 is the project id and hlpat-21321 is the access token (I put them random). I want to do the same thing but without exposing the access token directly. An idea would be to use stdin,meaning taking the token as an input from the user in the command line. How can I do it ?

Solution

Quoting curl man pages

Starting in 7.55.0, this option can take an argument in @filename style, which then adds a header for each line in the input file. Using @- will make curl read the header file from stdin.

use it as header instead and pass the header from stdin

curl --header -@ ...url... <<< "PRIVATE-TOKEN: private_token"

This way you dont need to pass to url

Answered By - Tolis Gerodimos

Answer Checked By - Cary Denson (WPSolving Admin)