GitLab OAuth

Glyph supports two unrelated GitLab integrations, mirroring GitHub:

1. GitLab OAuth login - users sign into Glyph itself with their GitLab account
2. Connected GitLab accounts (PAT) - users connect one or more GitLab accounts to import private projects

This page covers the first. For the second, see Connecting Accounts.

Creating the OAuth App

1. Go to gitlab.com/-/profile/applications (or your self-hosted instance).
2. Fill in:
   • Name: Glyph
   • Redirect URI: http://localhost:8000/api/auth/gitlab/callback (your APP_URL + /api/auth/gitlab/callback)
   • Confidential: checked
   • Scopes: read_user and read_api
3. Click Save application.
4. Copy the Application ID (this is your GITLAB_CLIENT_ID).
5. Copy the Secret (this is your GITLAB_CLIENT_SECRET).

Configuring Glyph

In your .env:

GITLAB_CLIENT_ID=<application id>
GITLAB_CLIENT_SECRET=<application secret>

Restart the backend:

docker compose restart backend

The login page now shows a Sign in with GitLab button alongside GitHub (if both are configured).

Self-hosted GitLab

For a self-hosted GitLab instance, the OAuth flow targets your instance, not gitlab.com. The OAuth URLs are derived from gitlab.com by default - to change them, override the backend setting gitlab_oauth_url (currently requires a code change; future versions will expose this as an env var).

How sign-in works

Identical to GitHub:

1. User clicks Sign in with GitLab
2. GitLab consent screen appears
3. Redirect to APP_URL/api/auth/gitlab/callback?code=...
4. Backend exchanges the code, fetches the user, creates/matches a Glyph user
5. JWT issued, user signed in

Production callback URL

When behind a reverse proxy:

• Update Redirect URI on gitlab.com to your public URL (e.g. https://api.glyph.example.com/api/auth/gitlab/callback)
• Update APP_URL in .env to match

Both must match exactly.

Disabling

Leave GITLAB_CLIENT_ID and GITLAB_CLIENT_SECRET empty. The login page hides the GitLab button.