Skip to main content
These token and webhook steps work for GitLab.com and self-hosted GitLab. For a self-hosted instance, first complete the GitLab sign-in setup.

​
Before you begin

  • A GitLab account with Maintainer access to every project you want reviewed.
  • Permission to create an access token for that account, or a group Owner who can create a group access token.
  • A project where you can open a merge request.

​
Choose who posts the reviews

CodeAnt posts review comments as the identity associated with the saved token. On GitLab.com, group access tokens require Premium or Ultimate. On GitLab Self-Managed, they are available with any license. See GitLab’s group access token requirements.

​
Create the access token

  1. Sign in to GitLab as the user who should post reviews.
  2. Open your profile settings and find Access tokens or Access → Personal access tokens, depending on your GitLab version.
  3. Create a token with the values below. If GitLab offers a choice between fine-grained and legacy tokens, use Legacy token for the scope-based configuration in this guide.
  1. Create the token and copy its value before leaving the page. GitLab displays it only once.
The token inherits the user’s project access. Confirm that this user has Maintainer access to the projects you want reviewed. See GitLab’s personal access token guide for the UI in your version.

​
Connect your projects

1

Save the token in CodeAnt AI

Sign in to the CodeAnt AI dashboard with GitLab. Open Settings → Configure Token and select Configure token. If a token is already saved, select Reconfigure.Paste the token and select Save & Configure Webhooks.
2

Select the projects to review

On Configure Repository Webhooks, select the projects you want reviewed. Start with one project, then select Create Webhooks (N), where N is the number selected.CodeAnt creates per-project webhooks and shows the installation results. Check that installation succeeded for your selected project before opening a merge request.
To connect more projects later, reopen Settings → Configure Token to configure webhooks for projects that are still missing them. For group-level webhooks or a manual installation, use the manual webhook guide.

​
Get your first review

Open a merge request in a project where webhook installation succeeded. CodeAnt AI reviews new merge requests and posts feedback directly on the MR. When it finds an issue, its comment explains the problem, severity, and suggested fix. See how to read a review comment. To review an existing MR or rerun a review, post this comment on the merge request:
The comments webhook must be installed for this command to reach CodeAnt.

​
Replace or remove the token

Before the token expires:
  1. Create a new token with the same scopes and project access.
  2. In CodeAnt AI, open Settings → Configure Token → Reconfigure.
  3. Save the new token and confirm that a review works.
  4. Revoke the old token in GitLab.
Existing webhooks do not need to be recreated just because the token changed. Reviews require a valid token for GitLab API access, so replace expired or revoked tokens even if webhook delivery still succeeds. To remove token access, select Delete on the Configure Token page and revoke the token in GitLab.

​
Troubleshooting

Confirm that the saved token has api and write_repository scopes and that its user has Maintainer access to the project. A group token must cover the intended group. Fix the access, then reconfigure the token and retry webhook installation. For a self-hosted instance, also check the network requirements.
Create a replacement token and save it through Reconfigure. An expired or revoked token cannot fetch changes or post review comments, even if GitLab continues sending webhook events.
Check the installation result for the project. In GitLab, open the project’s Settings → Webhooks and test the merge request webhook. A 2xx response confirms delivery, but does not confirm that a review completed. Check that the saved token is valid, then post @codeant-ai: review on the MR. If feedback still does not appear, contact CodeAnt support with the project, MR URL, and webhook response. Do not include your token.
CodeAnt uses the identity associated with the token. Replace your personal token with a dedicated bot user’s token or a group token, then request a new review. Existing comments retain their original author.

​
Next steps

Customize your reviews

Add review rules for your team’s coding standards.

Configure repository scans

Choose which analyses run and which files they include.