Getting GitLab phone verification codes onto a number your team controls

One-time number or Dedicated Number for GitLab: which should you pick?

Start with how long the account will live.

• OTP Gateway (one-time): right when you need a single GitLab code, such as checking that your own onboarding docs or a sign-up automation still work, or verifying a short-lived sandbox account. You choose a country, receive one code, and the number is gone afterward.
• Dedicated Virtual Number (US/Canada only, from $1.95/month): a better fit for a bot or service account your team will log into again for months, where GitLab might re-ask for verification. The number stays yours while it renews, inbound texts land in the dashboard and at your webhook as number.sms_received, and you can release it any time.

The one-time path is cheaper per event; the dedicated line avoids a future lockout on an account that matters. The temporary vs dedicated numbers article weighs this in more detail, and dedicated lines are described on the virtual numbers page.

When does GitLab ask for a GitLab phone number?

On GitLab.com, some newly registered users are asked to complete identity verification before they can do certain things, notably running pipelines on shared runners. Phone verification by SMS code is one of the accepted options. Self-managed GitLab instances are a different matter, since their administrators control sign-up rules themselves.

Two-factor authentication on GitLab relies on authenticator apps and hardware security keys rather than SMS, so the phone code you receive here is about proving identity at registration, not a recurring login factor.

Which countries can receive a GitLab code?

The gitlab service is currently routed in 197 countries, including the United States, Germany, India, Brazil, Poland, the Netherlands, Canada, France, Japan, Ukraine, Nigeria, Indonesia, Mexico, Spain, Turkey and Vietnam.

Pick the country that matches the person or team who actually owns the account. A contractor in Kraków verifying with a Polish number is coherent; an account registered from one region with a number from a completely different continent may draw extra scrutiny. For automated checks, match the country your test case is meant to represent.

How do I call the GitLab verification code API?

Authenticate against https://otproute.com/api/v1 with a Bearer key (prefix or_live_, up to 10 per account) from the Developer console.

1. Confirm availability with GET /api/v1/prices?country=<id>&service=gitlab; country ids come from GET /api/v1/countries.
2. Create the activation: POST /api/v1/activations with {"service": "gitlab", "country": "de"}, swapping in the country you need.
3. Enter the returned number on GitLab's verification page.
4. Receive the code by webhook, or poll GET /api/v1/activations/{id} every few seconds. If you abandon the attempt, call POST /api/v1/activations/{id}/cancel.

Add endpoints (up to five) for activation.sms_received, activation.expired and activation.cancelled. Validate X-OTPRoute-Signature (t=<unix>,v1=<hex>) by computing HMAC-SHA256 over "<t>.<raw body>" with the endpoint secret, reject old timestamps, and keep the handler idempotent on the activation id so a redelivered event does not trigger a second action. The limit is 300 requests per minute; see the docs.

No code? The dashboard path is simpler: pick GitLab and a country, order, paste the number into GitLab, and watch the code appear on the activation.

Why might a GitLab code fail to arrive?

GitLab, like many platforms, may refuse some virtual numbers or decline to send to particular ranges. When the SMS does not come:

• Let the 20-minute window finish before reacting.
• Try a different country route, or come back later, instead of placing new orders in a rapid loop.
• Make sure the number was entered with the correct country code on GitLab's form.
• Cancel the activation if you are done; no code means no charge, and the money returns to your wallet automatically.

Using OTP Route with GitLab responsibly

Follow GitLab's terms of service. One account per real person or business, and only accounts you are entitled to operate. Creating extra accounts to collect free CI minutes or to get around a suspension is abuse, not testing, and OTP Route's Acceptable Use Policy prohibits it.

Legitimate uses look like QA on your own developer-tool onboarding, giving a shared operations account a recovery number that is not someone's personal phone, or verifying the account of a new hire who should not have to expose a private number. GitLab is a trademark of its owner, and OTP Route is not affiliated with it.

Wallet and sandbox for GitLab SMS verification for testing

There is no subscription: fund a prepaid USD wallet by card or USDT/USDC and pay per received code. Each top-up and number purchase triggers a PDF invoice by email. Developers wiring this into a pipeline can ask support for sandbox mode on a development account, which returns simulated numbers and codes so the integration can be exercised end to end without wallet spend.

Frequently asked questions

What service id does GitLab use in the OTP Route API?

It is gitlab. Combine it with a country id from GET /api/v1/countries when you create an activation.

Can I receive a GitLab OTP without a SIM card?

Yes. A one-time OTP Gateway number receives the SMS, and you read the code in the dashboard or from the API.

Does GitLab accept every virtual number for GitLab verification?

No. GitLab may reject some numbers. If the code never arrives, the activation is refunded and you can try another country route later.

Can I use the same number again if GitLab asks me to re-verify?

Not with a one-time number. For an account you will keep, a Dedicated Number in the US or Canada from $1.95/month is the better choice.

How much is a GitLab verification number?

From $0.20 per code, depending on the country. The exact price comes from GET /api/v1/prices before you order.

Is GitLab SMS two-factor supported?

GitLab's two-factor login uses authenticator apps and security keys, not SMS. The phone code covers identity verification at sign-up.

Can my CI pipeline test our own GitLab-integrated onboarding?

Yes. Use the API with webhooks, or start in sandbox mode, and see the SMS OTP testing in CI guide.

Service names are trademarks of their respective owners. OTP Route is not affiliated with them. Use numbers lawfully, follow each service's terms and our Acceptable Use Policy.