GitLab

Overview

Connect your users to GitLab for repositories, merge requests, issues, and CI/CD.

Property	Value
Provider ID	gitlab
Category	Developer Tools
PKCE	Supported (S256)
Token refresh	Automatic (rotating refresh tokens)
Redirect URI	Shown in Developer Portal

Note

This provider targets gitlab.com. Self-managed GitLab instances use per-instance OAuth endpoints and are not covered.

Step 1: Create a GitLab OAuth Application

Open GitLab Applications

Navigate to User Settings > Applications (or a group/instance-level Applications page for shared apps) and sign in.

Add a new application

Click Add new application and enter a name.

Configure the redirect URI

Add the Alter callback URL (from the Developer Portal) to the Redirect URI field. Keep Confidential checked.

Select scopes

Select the scopes the application needs. See Available Scopes below.

Get credentials

Click Save application, then copy the Application ID (Client ID) and Secret (Client Secret). The secret is only shown once.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add GitLab provider

Go to OAuth Providers > Add Provider > GitLab.

Enter credentials

• Client ID: Paste your GitLab Application ID
• Client Secret: Paste your GitLab Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

API access

Scope	Description
read_user	Read-only access to the authenticated user’s profile
read_api	Read-only access to the API, including all groups and projects
api	Full read/write access to the API, including all groups and projects, the container registry, and the package registry

Repositories & registries

Scope	Description
read_repository	Read-only access to repositories on private projects via Git-over-HTTP or the Repository Files API
write_repository	Read/write access to repositories on private projects via Git-over-HTTP (not the API)
read_registry	Read-only (pull) access to container registry images on private projects
write_registry	Read/write (push) access to container registry images on private projects
read_virtual_registry	Read-only (pull) access to container images through the dependency proxy
write_virtual_registry	Read/write access to container images through the dependency proxy

CI/CD & operations

Scope	Description
create_runner	Create runners
manage_runner	Manage runners
k8s_proxy	Perform Kubernetes API calls via the agent for Kubernetes
read_observability	Read-only access to GitLab Observability
write_observability	Write access to GitLab Observability

AI & identity

Scope	Description
ai_features	Access GitLab Duo AI features
ai_workflows	Access GitLab Duo agent platform workflows
mcp	Access the GitLab Model Context Protocol (MCP) server
openid	Authenticate with GitLab via OpenID Connect
profile	Read-only access to the user’s profile data via OpenID Connect
email	Read-only access to the user’s primary email address via OpenID Connect

Administration

Scope	Description
sudo	Perform API actions as any user in the system (administrators only)
admin_mode	Perform API actions as an administrator when Admin Mode is enabled (administrators only)

Additional scopes

Scope	Description
mcp_orbit	Access the experimental GitLab MCP Orbit server
self_rotate	Rotate this token using the personal access token API
read_service_ping	Read-only access to Service Ping payload data
user:*	Composite user scope granted to service accounts for fine-grained access

Notes

• Prefer read_api plus narrower scopes over api when the integration is read-only — api grants full read/write access.
• OAuth access tokens expire after 2 hours; the rotating refresh token keeps the grant alive without re-authorization.
• See the GitLab OAuth documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
getApiV4Projects	read	GET	/api/v4/projects
getApiV4ProjectsId	read	GET	/api/v4/projects/{id}
postApiV4Projects	write	POST	/api/v4/projects
putApiV4ProjectsId	admin	PUT	/api/v4/projects/{id}
deleteApiV4ProjectsId	delete	DELETE	/api/v4/projects/{id}
getApiV4Groups	read	GET	/api/v4/groups
getApiV4GroupsId	read	GET	/api/v4/groups/{id}
getApiV4GroupsIdProjects	read	GET	/api/v4/groups/{id}/projects
getApiV4ProjectsIdIssues	read	GET	/api/v4/projects/{id}/issues
getApiV4ProjectsIdIssuesIssueIid	read	GET	/api/v4/projects/{id}/issues/{issue_iid}
postApiV4ProjectsIdIssues	write	POST	/api/v4/projects/{id}/issues
putApiV4ProjectsIdIssuesIssueIid	write	PUT	/api/v4/projects/{id}/issues/{issue_iid}
getApiV4ProjectsIdMergeRequests	read	GET	/api/v4/projects/{id}/merge_requests
getApiV4ProjectsIdMergeRequestsMergeRequestIid	read	GET	/api/v4/projects/{id}/merge_requests/{merge_request_iid}
postApiV4ProjectsIdMergeRequests	write	POST	/api/v4/projects/{id}/merge_requests
putApiV4ProjectsIdMergeRequestsMergeRequestIid	write	PUT	/api/v4/projects/{id}/merge_requests/{merge_request_iid}
getApiV4ProjectsIdJobs	read	GET	/api/v4/projects/{id}/jobs
getApiV4ProjectsIdPipelines	read	GET	/api/v4/projects/{id}/pipelines
postApiV4ProjectsIdPipeline	write	POST	/api/v4/projects/{id}/pipeline
getApiV4ProjectsIdReleases	read	GET	/api/v4/projects/{id}/releases
postApiV4ProjectsIdReleases	write	POST	/api/v4/projects/{id}/releases
getApiV4ProjectsIdRepositoryBranches	read	GET	/api/v4/projects/{id}/repository/branches
postApiV4ProjectsIdRepositoryBranches	write	POST	/api/v4/projects/{id}/repository/branches
getApiV4ProjectsIdRepositoryCommits	read	GET	/api/v4/projects/{id}/repository/commits
postApiV4ProjectsIdRepositoryCommits	write	POST	/api/v4/projects/{id}/repository/commits
getApiV4ProjectsIdRepositoryTags	read	GET	/api/v4/projects/{id}/repository/tags
getApiV4ProjectsIdRepositoryTree	read	GET	/api/v4/projects/{id}/repository/tree
getApiV4User	read	GET	/api/v4/user
getApiV4Users	read	GET	/api/v4/users
getApiV4UsersId	read	GET	/api/v4/users/{id}