Generate Client ID and Secret in GitLab Self-Hosted

Follow these steps to create an OAuth application in GitLab Self-Hosted and obtain the Client ID and Client Secret.

1. Register an OAuth Application

1. Log in to your GitLab Self-Hosted instance.

2. Navigate to Admin Area → Applications (/admin/applications),

   

3. or go to User Settings → Applications (/-/profile/applications) for user-specific tokens.

   

4. Click "New application".

   

5. Fill in the required details:

   

• Scopes: The following scopes are required for different areas:

  • read_api: For basic API access to GitLab endpoints
  • read_user: For accessing user information
  • read_repository: For accessing repository data and branches, reading and accessing issues
  • write_repository: For creating merge requests and managing webhooks, creating and managing issues
  • api: For general API access to all repository endpoints, managing CI/CD variables and secrets. Creating, updating, and deleting webhooks
  • openid: Required for OpenID Connect authentication
  • profile: Access to basic profile information
  • email: Access to user email information

• Trusted: Check this box for allowed Plexicus to use application credentials as a trusted first-party application.

• Name: Enter a meaningful name for the application.

• Redirect URI: the callback URL of your Plexicus deployment — https://<your-plexicus-domain>/api/callback/gitlab.

  On Plexicus SaaS that is https://app.plexicus.ai/api/callback/gitlab. On a self-hosted deployment substitute your own hostname: the value of global.domain in your Helm overlay, or PLEXICUS_DOMAIN on the evaluator — for example https://plexicus.acme.com/api/callback/gitlab or https://plexicus.local/api/callback/gitlab. It is the hostname your users log in on, with no api. prefix and no trailing slash. Getting this wrong is what produces invalid_redirect_uri after you click Authorize.

6. Click "Save application".

2. Get Client ID and Client Secret

aviso

Ensure you select the required scopes (openid, profile, email, read_api, read_user, read_repository, write_repository, api). We follow the principle of least privilege and only request permissions that are essential for Plexicus's functionality. These scopes provide the necessary access for authentication and repository operations while maintaining security.

After saving the application, GitLab will generate:

• Application ID (Client ID): Used as the client_id.
• Secret (Client Secret): Used as the client_secret.

aviso

Keep your Client Secret private and never expose it in public repositories or frontend applications.

3. Connect the Instance in Plexicus

A self-managed GitLab is connected per connection, inside Plexicus. It does not use the deployment-level GitLab credentials — the client id and secret you just generated are entered in the UI and stored against that one connection, so a single Plexicus deployment can serve gitlab.com and any number of self-managed instances at the same time. Nothing needs to be added to a Helm overlay or to the evaluator installer for this.

1. In Plexicus, open Connectors and click the GitLab card in the SCM panel.
2. Choose GitLab Self-Hosted (rather than GitLab.com).
3. Fill in the three fields:
   • Gitlab URL — the origin of your instance, e.g. https://gitlab.acme.com. Scheme and host only; no path, no trailing slash.
   • Gitlab Client ID — the Application ID from step 2.
   • Gitlab Client Secret — the Secret from step 2.
4. Click Connect. Plexicus redirects your browser to https://<your-gitlab-instance>/oauth/authorize, where you approve the requested scopes.
5. GitLab redirects back to https://<your-plexicus-domain>/api/callback/gitlab and the connector card shows Connected.

Your GitLab instance must be reachable from the Plexicus cluster (for API and clone traffic) and from your browser (for the authorize step). The redirect in step 5 is followed by the browser, so a hostname that resolves only inside your network is fine for OAuth — but see Webhooks for what that means for push-triggered rescans.

Troubleshooting

invalid_redirect_uri immediately after clicking Connect

The Redirect URI on the GitLab application does not match your Plexicus hostname. It must be exactly https://<your-plexicus-domain>/api/callback/gitlab — same scheme, no api. prefix, no trailing slash.

Authorization succeeds but no repositories are listed

One or more scopes were not granted. Re-open the application in GitLab and confirm all eight are ticked; GitLab does not re-prompt for scopes added after the first authorization, so revoke the existing grant and reconnect.

Merge requests are never opened for remediations

write_repository and api are missing from the granted scopes.