info:To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
info:To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
---
---
# GitLab as OAuth2 authentication service provider
# GitLab as OAuth2 authentication service provider
This document is about using GitLab as an OAuth authentication service provider
This document describes how you can use GitLab as an OAuth 2
to sign in to other services.
authentication service provider.
If you want to use:
If you want to use:
- The [OAuth2](https://oauth.net/2/) protocol to access GitLab resources on user's behalf,
- The [OAuth2](https://oauth.net/2/) protocol to access GitLab resources on user's behalf,
see [OAuth2 provider](../api/oauth2.md)
see [OAuth2 provider](../api/oauth2.md).
- Other OAuth authentication service providers to sign in to
- Other OAuth 2 authentication service providers to sign in to
GitLab, see the [OAuth2 client documentation](omniauth.md).
GitLab, see the [OAuth2 client documentation](omniauth.md).
- The related API, see [Applications API](../api/applications.md).
- The related API, see [Applications API](../api/applications.md).
## Introduction to OAuth
## Introduction to OAuth
[OAuth](https://oauth.net/2/) provides to client applications a 'secure delegated access' to server
[OAuth 2](https://oauth.net/2/) provides to client applications a 'secure delegated
resources on behalf of a resource owner. OAuth allows an authorization
access' to server resources on behalf of a resource owner. OAuth 2 allows
server to issue access tokens to third-party clients with the approval of the
authorization servers to issue access tokens to third-party clients with the approval
resource owner, or the end-user.
of the resource owner or the end-user.
OAuth is mostly used as a Single Sign-On service (SSO), but you can find a
OAuth 2 can be used:
lot of different uses for this functionality. For example, you can allow users
to sign in to your application with their GitLab.com account. You can also use GitLab.com
for authentication to your GitLab instance (see [GitLab OmniAuth](gitlab.md)).
The 'GitLab Importer' feature is also using the OAuth protocol to give access
- To allow users to sign in to your application with their GitLab.com account.
- To set up GitLab.com for authentication to your GitLab instance.
(see [GitLab OmniAuth](gitlab.md)).
The 'GitLab Importer' feature also uses OAuth 2 to give access
to repositories without sharing user credentials to your GitLab.com account.
to repositories without sharing user credentials to your GitLab.com account.
GitLab supports two ways of adding a new OAuth2 application to an instance. You
GitLab supports two ways of adding a new OAuth 2 application to an instance:
can either add an application as a regular user or add it in the Admin Area.
What this means is that GitLab can actually have instance-wide and a user-wide
applications. There is no difference between them except for the different
permission levels they are set (user or administrator). The default callback URL is