verapli
Sign inJoin free
Menu

Guides · devtools · Popular APIs

GitLab OAuth application

Register a user-owned or group-owned OAuth application on GitLab.com (or an instance-wide one on Self-Managed) to get an application ID and secret for OAuth 2.0 sign-in or API access.

Researched · not yet run liveLast researched 25 October 2026 · GitLab · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

An OAuth application belongs to a GitLab user or group (or the instance on Self-Managed).

  • GitLab user or group developerPrefer a group-owned application for team projects.

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Add a new application

    Avatar > Edit profile > Access > Applications > Add new application (or group Settings > Applications). Enter a name, redirect URI and the minimum scopes (e.g. read_user, openid), then Save.

    • verapli co-pilot
    • Human step: You press submit

    Where: https://gitlab.com/-/user_settings/applications

  2. Copy the Application ID and Secret

    Copy the Application ID and the Secret now; the secret is stored hashed and is only shown immediately after creation.

    • verapli co-pilot
    • After: Add a new application

    verapli captures GITLAB_OAUTH_CLIENT_SECRET here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (1)
    • Lost the secret: Use Renew secret, then update your app at once; the old secret stops working. [1]

    Where: https://gitlab.com/-/user_settings/applications

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Worth knowingThe rules say

Access tokens last 2 hours by default; using a refresh token invalidates the previous access and refresh tokens. [2]

What you end up with

Env varSecretFormatWhat it is
GITLAB_OAUTH_CLIENT_IDnot secretopaque id stringApplication ID
GITLAB_OAUTH_CLIENT_SECRETsecretopaque secret stringApplication secret

Pricing

  • No fee stated for registering OAuth applications on the pages reviewed [to verify].

Source [1]

For agents

The same entry as JSON: /api/v1/entries/gitlab/application · requirements /api/v1/requirements/gitlab/application · terms /api/v1/terms/gitlab/application.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for GitLab OAuth application, and how long will it take?"
  → tools/call requirements { "provider_id": "gitlab/application" }

Sources

  1. Configure GitLab as an OAuth 2.0 authentication identity provider User-owned apps via Edit profile > Access > Applications; group-owned via group Settings > Applications; instance-wide via Admin (Self-Managed, can be trusted); fields Name, Redirect URI, Scopes; secret stored hashed and only available right after creation; Renew secret breaks the app until updated; access tokens expire after 2 hours by default. · accessed 25 October 2026 · official
  2. OAuth 2.0 identity provider API Authorization code with PKCE is most secure and needs no client secret for public clients; refresh invalidates old access and refresh tokens; expires_in 7200 in examples. · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. GitLab is not affiliated with verapli.