---
title: "Fixing 403 Errors When Accessing Archive Packages via CI JOB TOKEN in GitLab 18"
date: 2025-06-17T14:32:11.000Z
author: Z.SHINCHVEN
tags: [GitLab, CI/CD, DevOps, Job Token, Package Registry]
canonical: https://atlassc.net/2025/06/17/gitlab-ci-job-token-403
---
If your GitLab CI pipeline started throwing `403 Forbidden` errors when trying to access archive packages using the `CI_JOB_TOKEN`, you're likely running into a security change that became **enforced by default** in **GitLab 18**.

This isn’t a brand-new feature—but now, **you’re required to explicitly configure access permissions**, or your jobs will fail.

## 📍 What Changed in GitLab 18?

GitLab has supported the concept of **scoped job token permissions** since GitLab 15.9. This feature allowed project maintainers to restrict which other projects or groups could access their resources using `CI_JOB_TOKEN`.

For a while, this behavior was optional or hidden behind feature flags. But as of **GitLab 18**, the old implicit access is gone. You must now **explicitly authorize projects or groups**—otherwise, your job token will be denied access by default.

## ❗ The Symptom

If you're seeing something like this in your CI logs:

```
error: failed to download package: 403 Forbidden
```

You're likely trying to fetch a package or archive from another project without having the correct permissions set up under GitLab's updated security model.

## ✅ How to Fix It

To allow a CI job from one project to access another project’s archive packages using `CI_JOB_TOKEN`:

1. Go to the **target project** (the one hosting the archive).
2. Navigate to **Settings → CI/CD**.
3. Expand the **"Job token permissions"** section.
4. Under **Authorized groups and projects**, add the **source group or project** that needs access.
5. Save changes.

That’s it — this will grant the necessary access for your pipelines to function as expected under GitLab 18.

## 💡 Tip for DevOps Teams

Review your existing pipelines before upgrading to GitLab 18. If your workflows rely on cross-project access via `CI_JOB_TOKEN`, make sure those permissions are configured ahead of time to avoid unexpected pipeline failures.

## 🔁 Summary

* This isn’t a new feature in GitLab 18 — it’s now **mandatory**.
* You must **explicitly authorize job token access** in the target project’s settings.
* Failing to do so will result in **403 Forbidden** errors when accessing packages.

By updating your project permissions, your CI/CD pipelines will be back on track—and more secure than before.

## 📚 Sources

- [Limit your project’s job token access (removed)](https://docs.gitlab.com/ci/jobs/ci_job_token/#:~:text=Limit%20your%20project's%20job%20token%20access%20(removed)&text=The%20Limit%20access%20from%20this,to%20the%20allowlist%20for%20A%20.)