An incoming email token is a secret value tied to a specific user email address in GitLab. When GitLab receives mail sent to that address, the token helps verify that the message is authorized to perform email-based actions, such as creating an issue or opening a merge request on behalf of that user.
This matters because the token acts like a credential, not just an address. If it is exposed, an attacker may be able to submit trusted-looking requests through a mail workflow without logging in through the web interface. That can bypass assumptions about VPNs, IP allowlists, or browser sessions, because email handling is a separate access path. Defenders should treat the address as sensitive, restrict where email-based actions are enabled, enforce branch protection and approvals, and reset the token promptly if exposure is suspected.