Skip to main content
Connect your GitLab account to let CloudThinker agents read repositories, merge requests, and failing pipelines — and to run Review on the projects you select. GitLab.com authenticates with OAuth; self-hosted GitLab uses a project or group access token.

​
Prerequisites

  • A GitLab account with access to the projects you want CloudThinker to reach.
  • For OAuth: permission to authorize CloudThinker for your GitLab.com account.
  • For access tokens: permission to create a project or group access token; self-hosted instances need GitLab version 12.0 or above.

​
Setup

Navigate to Connections → GitLab in your CloudThinker workspace, click Connect, then pick an authentication method.
1

Start the OAuth flow

Click Connect to GitLab. CloudThinker redirects you to GitLab’s authorization page.
2

Authorize CloudThinker

Sign in to the GitLab account that can access the projects you want CloudThinker to use, then approve access.
3

Return to CloudThinker

After authorization, CloudThinker stores the OAuth tokens and shows a Connected status.
Review needs one extra step on GitLab: a manual webhook in your project or group. Follow Configure webhooks.

​
Connection details

​
Required permissions

  • OAuth inherits the access of the authorizing GitLab account.
  • Access tokens need the api scope and the Developer role or higher — Guest and Reporter roles cannot post comments on merge requests.
  • Write operations such as branch and merge request changes additionally require explicit approval in CloudThinker.
Prefer a project or group access token over a personal one: comments appear from a bot user, the token stays scoped to the projects you pick, and revoking it touches nothing else.

​
Repository access

On top of what your OAuth account or access token can reach, the connection carries a CloudThinker-side repository policy. Open the connection’s detail panel and find Repository access under Settings: The policy only ever narrows what the credential already grants, and it is separate from choosing which projects run Review. Switching from Selected to All and back restores your previous selection.

​
Agent capabilities

Once connected, agents can:

​
Verify the connection

​
Example prompts

​
Write access

Reads run without approval. Any change to a branch or a merge request is approval-gated: CloudThinker states the effect and the exact inputs, then waits for your confirmation before touching the project.

​
Troubleshooting

The token is expired, lacks the api scope, or its role is below Developer. Create a new project or group access token with the api scope and the Developer role or higher, then validate again.
Check the GitLab URL — use the bare instance URL without a trailing path, and confirm the instance is reachable from the internet. CloudThinker supports self-hosted GitLab version 12.0 and above.
A project token reaches one project; a group token reaches only that group’s projects. Reconnect with a group token for the owning group, or with an account that has access to the missing project.
GitLab requires a manual webhook for Review. Add it in your project or group under Settings → Webhooks following Configure webhooks.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Scoped tokens — a project or group access token limits CloudThinker to exactly the projects you pick and posts as a bot user.
  • Set expirations — give tokens an expiration date and rotate them before they lapse.

Review Setup

Turn on automated AI code reviews for your GitLab projects

Provider Authentication

Authentication and webhook details for every Review provider