Fixing 403 Errors When Accessing Archive Packages via CI JOB TOKEN in GitLab 18

If your GitLab CI pipeline started throwing 403 Forbidden errors when trying to access archive packages using the CI_JOB_TOKEN, you're likely running into a security change that became enforced by default in GitLab 18.

This isn’t a brand-new feature—but now, you’re required to explicitly configure access permissions, or your jobs will fail.

📍 What Changed in GitLab 18?

GitLab has supported the concept of scoped job token permissions since GitLab 15.9. This feature allowed project maintainers to restrict which other projects or groups could access their resources using CI_JOB_TOKEN.

For a while, this behavior was optional or hidden behind feature flags. But as of GitLab 18, the old implicit access is gone. You must now explicitly authorize projects or groups—otherwise, your job token will be denied access by default.

❗ The Symptom

If you're seeing something like this in your CI logs:

Wrap|Copy
error: failed to download package: 403 Forbidden

You're likely trying to fetch a package or archive from another project without having the correct permissions set up under GitLab's updated security model.

✅ How to Fix It

To allow a CI job from one project to access another project’s archive packages using CI_JOB_TOKEN:

1. Go to the target project (the one hosting the archive).
2. Navigate to Settings → CI/CD.
3. Expand the "Job token permissions" section.
4. Under Authorized groups and projects, add the source group or project that needs access.
5. Save changes.

That’s it — this will grant the necessary access for your pipelines to function as expected under GitLab 18.

💡 Tip for DevOps Teams

Review your existing pipelines before upgrading to GitLab 18. If your workflows rely on cross-project access via CI_JOB_TOKEN, make sure those permissions are configured ahead of time to avoid unexpected pipeline failures.

🔁 Summary

• This isn’t a new feature in GitLab 18 — it’s now mandatory.
• You must explicitly authorize job token access in the target project’s settings.
• Failing to do so will result in 403 Forbidden errors when accessing packages.

By updating your project permissions, your CI/CD pipelines will be back on track—and more secure than before.

📚 Sources

• Limit your project’s job token access (removed)