Before you start
- Access to the GitLab project (gitlab.com or a self-managed instance).
- For self-managed GitLab, the instance host must be allow-listed by your administrator.
Step-by-step
- 1
Connect
Integrations → GitLab → Connect, then "Continue with GitLab". The app uses OAuth with PKCE.
- 2
Self-managed instances
If you run your own GitLab, provide the instance URL. Only https hosts that your administrator has allow-listed are accepted (this prevents server-side request forgery).
- 3
Select the project
Enter the numeric Project ID that issues should be created in.
Security best practices
- OAuth with PKCE avoids storing a long-lived personal access token.
- Self-managed instance URLs are validated to be public https hosts; private/link-local addresses are rejected.
- If you enable webhooks, set and verify a secret token on every delivery.
- Credentials are encrypted at rest with AES-256-GCM — they are never stored in plain text.
- Only organization owners and admins can create or modify a connection.
- Prefer OAuth where available: it issues short-lived, scoped, revocable tokens instead of long-lived secrets.
- When you must use a token, create a fine-grained, least-privilege token and rotate it periodically.