Permissions for maven package repository

Dear list,

I just created a succesful maven package repository for one of our projects. Our other projects need this maven repository for their dependencies.

One of the collaborators on the client project couldn’t get access to the maven package repository. She got an access denied error when maven tried to download a pom.xml from the package repository.

Her permission for the project of the maven repository was “guest”. When I upgraded her to developer permission for the project of the maven repository, it was OK, and she could get access. But she is not a developer of this project hosting the maven repository.

She used a personal access token in her gitlab.com profile, and we do everything on gitlab.com.

Question:
Is it true that she needs developer permissions in order to use the maven repository of a project in some client project?
Is it possible that she can use the maven package repository as a dependency in client project, without having to grant her developer access for the project of the repository?

Any help would be appreciated.