Fixing my formatting in case this proves useful to anyone:

  machine {server} # e.g. gitlab.com
  login {username}
  password {read_only_api_key} # Must be actual key and not an ENV var