Identity verification
-
Introduced in GitLab 15.4 with a flag named
identity_verification. Disabled by default.
Identity verification provides multiple layers of GitLab account security. Depending on your risk score, you might be required to perform up to three stages of verification to register an account:
- All users - Email verification.
- Medium-risk users - Phone number verification.
- High-risk users - Credit card verification.
Users created after signing in with SAML SSO for GitLab.com groups are exempt from identity verification.
Email verification
To register an account, you must provide a valid email address. See Account email verification.
Phone number verification
In addition to email verification, you might have to provide a valid phone number and verify a one-time code.
You cannot verify an account with a phone number associated with a banned user.
Unsupported countries
Phone number verification is not supported for numbers from the following countries:
- Bangladesh
- China
- Cuba
- Hong Kong
- Indonesia
- Iran
- Macau
- Malaysia
- North Korea
- Pakistan
- Russia
- Saudi Arabia
- Syria
- United Arab Emirates
- Vietnam
Users with phone numbers from unsupported countries can try credit card verification, or create a support ticket.
Partially supported countries
A user might not receive a one-time password (OTP) if their phone number is from an partially supported country. Whether a message is delivered depends on country enforcement and regulation.
The following countries are partially supported:
- Armenia
- Belarus
- Cambodia
- Eswatini
- Haiti
- Kazakhstan
- Kenya
- Kuwait
- Mexico
- Myanmar
- Nigeria
- Oman
- Philippines
- Qatar
- South Africa
- Tanzania
- Thailand
- Turkey
- Uganda
- Ukraine
- Uzbekistan
Users with phone numbers from partially supported countries can try credit card verification, or create a support ticket.
Credit card verification
In addition to email and phone number verification, you might have to provide a valid credit card number.
You cannot verify an account with a credit card number associated with a banned user.