Identity verification

DETAILS: Tier: Free, Premium, Ultimate Offering: GitLab.com

Introduced in GitLab 15.4 with a flag named identity_verification. Disabled by default.

Enabled on GitLab.com in GitLab 16.0.

Generally available in GitLab 16.11. Feature flag identity_verification removed.

Identity verification provides multiple layers of GitLab account security. Depending on your risk score, you might be required to perform up to three stages of verification to register an account:

All users - Email verification.
Medium-risk users - Phone number verification.
High-risk users - Credit card verification.

Users created after signing in with SAML SSO for GitLab.com groups are exempt from identity verification.

Email verification

To register an account, you must provide a valid email address. See Make new users confirm email.

Phone number verification

In addition to email verification, you might have to provide a valid phone number and verify a one-time code.

You cannot verify an account with a phone number associated with a banned user.

Unsupported countries

Phone number verification is not supported for numbers from the following countries:

Bangladesh
China
Cuba
Hong Kong
Indonesia
Iran
Macau
Malaysia
North Korea
Pakistan
Russia
Saudi Arabia
Syria
United Arab Emirates
Vietnam

Users with phone numbers from unsupported countries can try credit card verification, or create a support ticket.

Partially supported countries

A user might not receive a one-time password (OTP) if their phone number is from an partially supported country. Whether a message is delivered depends on country enforcement and regulation.

The following countries are partially supported:

Armenia
Belarus
Cambodia
Eswatini
Haiti
Kazakhstan
Kenya
Kuwait
Mexico
Myanmar
Nigeria
Oman
Philippines
Qatar
South Africa
Tanzania
Thailand
Turkey
Uganda
Ukraine
Uzbekistan

Users with phone numbers from partially supported countries can try credit card verification, or create a support ticket.

Credit card verification

In addition to email and phone number verification, you might have to provide a valid credit card number.

You cannot verify an account with a credit card number associated with a banned user.