> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# GitLab Access Token

> Connect your GitLab projects, install webhooks, and receive your first merge request review.

> [!NOTE]
>
> These token and webhook steps work for GitLab.com and self-hosted GitLab. For a self-hosted instance, first complete the [GitLab sign-in setup](https://docs.codeant.ai/setup/gitlab/self-hosted/control_center.md).

## Before you begin

* A GitLab account with **Maintainer** access to every project you want reviewed.
* Permission to create an access token for that account, or a group Owner who can create a group access token.
* A project where you can open a merge request.

## Choose who posts the reviews

CodeAnt posts review comments as the identity associated with the saved token.

| Token type | When to use it |
| - | - |
| Personal access token | Try CodeAnt with your own account. Comments are attributed to you, and access depends on your project membership. |
| Dedicated bot user's personal access token | Keep automated comments separate from developer activity. Create a dedicated GitLab user, such as `codeant-ai-bot`, and give it Maintainer access to the projects. |
| Group access token | Use a GitLab-created bot identity for one group and its projects. A group Owner must create the token. |

On GitLab.com, group access tokens require Premium or Ultimate. On GitLab Self-Managed, they are available with any license. See [GitLab's group access token requirements](https://docs.gitlab.com/user/group/settings/group_access_tokens/).

## Create the access token

> [tab] Personal or bot user's token
>
> 1. Sign in to GitLab as the user who should post reviews.
> 2. Open your profile settings and find **Access tokens** or **Access** → **Personal access tokens**, depending on your GitLab version.
> 3. Create a token with the values below. If GitLab offers a choice between fine-grained and legacy tokens, use **Legacy token** for the scope-based configuration in this guide.
>
> | Field | Value |
> | - | - |
> | Token name | `CodeAnt AI` |
> | Expiration date | A date allowed by your organization's policy; plan to replace the token before then |
> | Scopes | `api`, `write_repository` |
>
> 4. Create the token and copy its value before leaving the page. GitLab displays it only once.
>
> The token inherits the user's project access. Confirm that this user has **Maintainer** access to the projects you want reviewed. See [GitLab's personal access token guide](https://docs.gitlab.com/user/profile/personal_access_tokens/) for the UI in your version.

> [tab] Group token
>
> 1. As a group Owner, open the group in GitLab.
> 2. Go to **Settings** → **Access tokens** → **Add new token**.
> 3. Enter these values:
>
> | Field | Value |
> | - | - |
> | Token name | `CodeAnt AI` |
> | Expiration date | A date allowed by your organization's policy; plan to replace the token before then |
> | Role | `Maintainer` |
> | Scopes | `api`, `write_repository` |
>
> 4. Select **Create group access token** and copy the value before leaving the page.
>
> Use the token for projects in the group where it was created. See [GitLab's group access token guide](https://docs.gitlab.com/user/group/settings/group_access_tokens/) for scope and access details.

## Connect your projects

**1. Save the token in CodeAnt AI**

Sign in to the [CodeAnt AI dashboard](https://app.codeant.ai) with GitLab. Open **Settings** → **Configure Token** and select **Configure token**. If a token is already saved, select **Reconfigure**.

Paste the token and select **Save & Configure Webhooks**.

**2. Select the projects to review**

On **Configure Repository Webhooks**, select the projects you want reviewed. Start with one project, then select **Create Webhooks (N)**, where `N` is the number selected.

CodeAnt creates per-project webhooks and shows the installation results. Check that installation succeeded for your selected project before opening a merge request.

> [!TIP]
>
> To connect more projects later, reopen **Settings** → **Configure Token** to configure webhooks for projects that are still missing them. For group-level webhooks or a manual installation, use the [manual webhook guide](https://docs.codeant.ai/setup/gitlab/manual-webhooks.md).

## Get your first review

Open a merge request in a project where webhook installation succeeded. CodeAnt AI reviews new merge requests and posts feedback directly on the MR. When it finds an issue, its comment explains the problem, severity, and suggested fix. See [how to read a review comment](https://docs.codeant.ai/pull_request/features/code_review.md).

To review an existing MR or rerun a review, post this comment on the merge request:

```text theme={"theme":"css-variables"}
@codeant-ai: review
```

The comments webhook must be installed for this command to reach CodeAnt.

## Replace or remove the token

Before the token expires:

1. Create a new token with the same scopes and project access.
2. In CodeAnt AI, open **Settings** → **Configure Token** → **Reconfigure**.
3. Save the new token and confirm that a review works.
4. Revoke the old token in GitLab.

Existing webhooks do not need to be recreated just because the token changed. Reviews require a valid token for GitLab API access, so replace expired or revoked tokens even if webhook delivery still succeeds.

To remove token access, select **Delete** on the Configure Token page and revoke the token in GitLab.

## Troubleshooting

> [accordion] My project is missing or webhook installation failed
>
> Confirm that the saved token has `api` and `write_repository` scopes and that its user has Maintainer access to the project. A group token must cover the intended group. Fix the access, then reconfigure the token and retry webhook installation. For a self-hosted instance, also check the [network requirements](https://docs.codeant.ai/setup/gitlab/self-hosted/control_center.md#network-requirements).

> [accordion] CodeAnt reports that my GitLab token expired
>
> Create a replacement token and save it through **Reconfigure**. An expired or revoked token cannot fetch changes or post review comments, even if GitLab continues sending webhook events.

> [accordion] My merge request has not received a review
>
> Check the installation result for the project. In GitLab, open the project's **Settings** → **Webhooks** and test the merge request webhook. A 2xx response confirms delivery, but does not confirm that a review completed. Check that the saved token is valid, then post `@codeant-ai: review` on the MR. If feedback still does not appear, [contact CodeAnt support](mailto:support@codeant.ai) with the project, MR URL, and webhook response. Do not include your token.

> [accordion] Review comments show my name
>
> CodeAnt uses the identity associated with the token. Replace your personal token with a dedicated bot user's token or a group token, then request a new review. Existing comments retain their original author.

## Next steps

> [card] [Customize your reviews](https://docs.codeant.ai/pull_request/customize/rules.md)
>
> Add review rules for your team's coding standards.

> [card] [Configure repository scans](https://docs.codeant.ai/repositories/analysis_configuration.md)
>
> Choose which analyses run and which files they include.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.