GitLab signs users in with their GitLab.com account. Because GitLab's OAuth provider is OpenID Connect compliant, this connector gets a proper `id_token` and a userinfo endpoint — including a `email_verified` claim, which most developer connectors do not provide.

## Copy the redirect URI

In the [Authdog console](https://console.authdog.com), select the project and environment, open **Authentication > Providers**, find **GitLab**, and click **Enable**. Copy the redirect URI shown in the form:

```url
https://identity.authdog.com/api/v1/callback/<connectionId>
```

## Create the application

1. Open [Applications in your GitLab user settings](https://gitlab.com/-/user_settings/applications). For an app your team shares, create it under **Group settings > Applications** instead.
2. Select **Add new application**.
3. Name it.
4. Under **Redirect URI**, paste the redirect URI from Authdog. GitLab accepts several, one per line, so all your environments can share one application.
5. Leave **Confidential** checked — Authdog exchanges the code from the server with a client secret.
6. Select the scopes `openid`, `email`, and `profile`.
7. Save, then copy the **Application ID** and **Secret**.

## Configure Authdog

| Field | Value |
| --- | --- |
| **Client ID** | GitLab **Application ID** |
| **Client Secret** | GitLab **Secret** |

Save, then toggle the connection **active**.

## What GitLab returns

Authdog requests `openid email profile` and reads the profile from `https://gitlab.com/oauth/userinfo`: the `sub` identifier, email and its verified flag, username, name, and avatar.

The connector targets GitLab.com. A self-managed GitLab instance runs the same endpoints on your own host, which this connector does not point at — configure it through the generic **OpenID Connect** connector under [Enterprise SSO](/docs/sso), using your instance's discovery URL.

## Test it

1. Open your environment's hosted sign-in page, or link to `https://identity.authdog.com/api/v1/signin/<connectionId>`.
2. Select **Continue with GitLab** and authorize.
3. Confirm the user appears under **Users** with a verified email.

## Troubleshooting

| Symptom | Cause |
| --- | --- |
| `The redirect URI included is not valid` | The URI is missing from the application's redirect list |
| `invalid_scope` | `openid`, `email`, or `profile` was not selected on the application |
| `invalid_client` | Application ID or secret mismatch, or the application was created as non-confidential |
| Sign-in fails only for self-managed users | This connector targets GitLab.com — use an OIDC enterprise connection |

## Related

| Read | To learn how to |
| --- | --- |
| [Connectors](/docs/connectors) | Set up any other social provider |
| [GitHub](/docs/connectors/github) | Add the other developer identity provider |
| [Enterprise SSO](/docs/sso) | Point a generic OIDC connection at a self-managed instance |