Skip to main content
Connect GitLab.com or your own GitLab instance using OAuth. After authorization, choose the projects to connect, including private projects your GitLab account can access.

​
Prerequisites

  • A GitLab account with access to the projects you want to connect
  • Maintainer or Owner permissions on projects where Corelayer will register webhooks
  • For self-hosted GitLab, permission to create an OAuth application on that instance
  • For Corelayer Cloud, a self-hosted instance reachable from Corelayer over public HTTPS with a valid TLS certificate; a localhost or VPN-only URL will not work

​
Step-by-Step Setup

​
1. Add GitLab in Corelayer

Open Integrations in your Corelayer dashboard, click Add Integration, and select GitLab. Select the workspace where you want to connect it.

​
2. Choose Your GitLab Instance

For GitLab.com, leave GitLab URL as https://gitlab.com. You do not need to create an OAuth application. Continue to Configure Preferences. For self-hosted GitLab, enter your instance’s base URL, such as https://gitlab.example.com. Corelayer displays the OAuth redirect URI and fields for Application ID and Application secret.

​
3. Create an OAuth Application for Self-Hosted GitLab

Keep the Corelayer setup dialog open and open your GitLab instance in another tab:
  1. Select your avatar, then Edit profile > Access > Applications.
  2. Select Add new application and give it a recognizable name, such as Corelayer.
  3. Copy the OAuth redirect URI from Corelayer into GitLab’s Redirect URI field. Wait for the callback URL to load before copying it.
  4. Leave Confidential enabled and select the api scope.
  5. Save the application and copy its Application ID and Secret.
  6. Return to Corelayer and paste them into Application ID and Application secret.
Use credentials created on the same GitLab instance as the URL you entered. A personal access token is not an OAuth application secret.
Copy the redirect URI exactly as displayed in Corelayer. For Corelayer Cloud it is https://app.corelayer.com/api/integrations/gitlab/oauth/callback. Connect from the Corelayer origin shown in that URI.
The api scope grants read and write API access within the authorizing user’s permissions, including webhook management. The merge request preference below controls whether Corelayer may create merge requests; it does not reduce the OAuth scope. See GitLab’s OAuth application documentation for application settings and scopes.

​
4. Configure Preferences

Choose whether to enable:
  • Code indexing — Allow Corelayer to index and securely store your code for faster analysis.
  • Allow Corelayer to create merge requests — Allow Corelayer to open merge requests using the granted GitLab permissions.
Both options are off by default.

​
5. Authorize Corelayer

Click Connect with GitLab. For self-hosted instances, this button becomes available after the OAuth settings finish loading. Sign in to the GitLab instance you selected, review the requested access, and authorize the application. GitLab redirects you back to Corelayer.

​
6. Select Projects and Sync

Open the connected GitLab integration in Corelayer:
  1. Click Choose projects.
  2. Select the projects you want to connect, then click Save changes.
  3. Click Sync to synchronize the selected projects and register their webhooks.
Only selected projects are connected in Corelayer. Private projects appear when the authorizing GitLab account has access to them. Corelayer refreshes expired OAuth access tokens automatically using the saved credentials for your instance.

​
Verify the Connection

  • Confirm that the integration shows the expected GitLab account and selected projects.
  • Run Sync and confirm it completes.
  • Push a commit to a selected project. In that project’s GitLab Settings > Webhooks, check that the Corelayer push webhook delivery receives an HTTP 200 response.

​
Troubleshooting

​
Redirect URI Mismatch

Compare the application’s Redirect URI with the callback shown in the Corelayer dialog. They must match exactly, including the scheme, host, and path. Start the connection again after correcting the GitLab application.

​
OAuth Settings Stay Loading

Close and reopen the setup dialog to retry loading the callback URL. If Corelayer asks you to open a different Corelayer origin, use that address to start the connection.

​
Authorization or Token Refresh Fails

Check that the Application ID and secret belong to the instance you entered, the application is confidential, and the api scope is selected. If you revoke authorization, delete the application, or rotate its secret, reconnect in Corelayer with valid credentials.

​
Projects Are Missing or Sync Fails

Confirm the authorizing GitLab user can access the projects. Webhook registration requires sufficient project permissions. For self-hosted GitLab, also check that Corelayer can reach the instance over HTTPS and that GitLab can deliver webhooks to Corelayer. Need help? Contact support for assistance with your GitLab integration.