Gitlab duo provider is not working with Self Hosted instances.

Description

I am using Opencode with a self hosted gitlab instance.
I got an error when trying to send a message.

GitlabError: Failed to get direct access token: 403 Forbidden - {"Message":"403 Forbidden"}

I use the PAT method to login. (Even Gitlab show the token to be used recently).

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

macos sonoma 14.8.2

Terminal

kitty / iterm2

This issue might be a duplicate of existing issues. Please check:

GitLab Duo /models selection still responds as Claude 3.5 Sonnet #8367: GitLab Duo /models selection still responds as Claude 3.5 Sonnet - This issue also involves GitLab Duo provider problems with authentication/configuration
[FEATURE]: Add GitLab Duo Agentic Chat Provider Support #7455: [FEATURE]: Add GitLab Duo Agentic Chat Provider Support - The feature request tracking GitLab Duo support for both GitLab.com and self-hosted instances
opencode error when starting the command #8509: opencode error when starting the command - Another GitLab-related error ("TypeError: undefined is not an object (evaluating 'input.id')") that may be related

Feel free to ignore if none of these address your specific case.

@vglafirov

@vglafirov I created an issue for Gitlab instances

@gaetan-puleo

@gaetan-puleo Could you please provide GitLab version you are currently running?

@vglafirov

@vglafirov v18.6.1-ee

Same here on v18.7.1-ee

Thanks for posting the versions. They are relatively new, which is good. Could you please tell me if you use OAuth or PAT authentication? Could you please try both methods? If it's PAT, make sure it has API access, if PAT is old, try to create a new one and test it.

@vglafirov

@vglafirov I created a PAT yesterday with API Access, but I couldn't use Oauth because OpenCode tried to log me in gitlab.com and not the self hosted instance. I'll try again

Same behavior using /connect and selecting gitlab duo (oauth method)

When using "opencode auth login" I can enter a gitlab instance URL. Ok we need to avoid using /connect when opencode is running.

"Client authentication failed due to unknown client, no client authentication included, or unsupported authentication method."

I guess oauth is not possible with my instance

Yeah, for OAuth you might need to register your own application. I am currently investingating this. I will keep you posted.

Another question: Have you tried Duo-CLI ? Does this work for you? It doesn't mean we should not fix OpenCode, it's a part of debug process :) Trying to find the difference.

@vglafirov

Another question: Have you tried Duo-CLI ? Does this work for you? It doesn't mean we should not fix OpenCode, it's a part of debug process :) Trying to find the difference.

I just connected duo cli to the instance and try to send a message, it works and it can find my project @vglafirov

@vglafirov

I think I found the bug, it's not related to OpenCode it's related to AI Gateway: https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/merge_requests/4288

Let's see if it works once it's merged.

Hi @vglafirov, I noticed that the MR has merged and the AI Gateway has released a new version. Here’s the link: https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/releases/v1.261.2. However, I tested opencode with GitLab Duo and it still complains with an error: “GitLabError: Anthropic API error: 403 {“detail”:”Gitlab instance uid mismatch”}”

I now get this error:

GitLabError: Failed to get direct access token: 503 Service Unavailable - {"message":"Token creation failed"}

Hi all

Thanks for everyone's input with the mob-debugging. Thanks to this thread I have reproducable steps to get opencode working with Duo in my organisation (on a self-hosted instance).

Steps:

Enable Duo Agent Platform for the user/group/instance.
Ensure the following feature flags are enabled (root access required. No restart required)
- Feature.enabled?(:agent_platform_claude_code)
- Feature.enabled?(:third_party_agents_enabled)
Ensure your instance's personal access tokens have the prefix glpat- set (Admin > Settings > General > Account and limit > Access token prefix)
Create a new PAT with api and ai_features scopes.
Run opencode auth login in your terminal (do not use /connect command)
Select Duo, type in your instance URL and paste in your PAT.
I do not know why, but the following env vars must also be set (eg through direnv or .bashrc or export ...)
- GITLAB_INSTANCE_URL=https://gitlab.example.com
- GITLAB_TOKEN=glpat-xxxxx
Run opencode, use /models to select one of the models under Duo, and Bob's your uncle.

Versions:

opencode 1.1.19
Gitlab v18.7.1-ee

@J4NS-R

I can confirm this it is working now. The fix has been merged, but not deployed until this EMEA morning, due to the change lock, preventing weekend deployments. Now it's been deployed and the issue with UID mismatch has gone. @J4NS-R Thanks for testing this.

Enable Duo Agent Platform for the user/group/instance.
Ensure the following feature flags are enabled (root access required. No restart required)
Feature.enabled?(:agent_platform_claude_code)
Feature.enabled?(:third_party_agents_enabled)

I do not know why, but the following env vars must also be set (eg through direnv or .bashrc or export ...)
GITLAB_INSTANCE_URL=https://gitlab.example.com

These two things are required, indeed. The rest, you mention, is not necessary. Token with glpat- prefix will be created automatically on newer versions of GitLab (17+).

You can also specify GITLAB_AI_GATEWAY_URL environment variable, in case you run your own AI Gateway.

@J4NS-R

Thanks a lot @J4NS-R, it is working now.

On my side, the only thing missing was the opencode auth login part.

@rekram1-node

@rekram1-node This issue can be closed. It's working now. Updated documentation as follow-up MR

Thanks a lot @J4NS-R, it is working now.

On my side, the only thing missing was the opencode auth login part.

opencode auth login command does the same as /connect, stores PAT in auth.json file.

I tested opencode with GitLab Duo and it still complains with an error: “GitLabError: Anthropic API error: 403 {“detail”:”Gitlab instance uid mismatch”}”

Im having this error too, GitLab v18.6.1-ee

@Pipyakas

@Pipyakas Please, go to the Admin area of your instance and execute a health check, GitLab Duo -> "Run health check", make sure everything is 🟢

There's still a few issues:

When using /connect with PAT, the instance url is never asked for which presumably means it will default to gitlab.com instead of using the private instance url
I do NOT want to have to set env vars---this defeats the whole purpose of entering the instance url and the PAT during opencode auth login
allowing oauth to work with private instances would be great

@calebdw

@calebdw Interesting observation, thanks. I am always relying on environment variable, TBH, but you are right, instance URL can be stored in auth storage.I think this issue can be closed, since it's working now. Could you please create a dedicated issue for this usecase?

cc: @rekram1-node

Yeah we should have additional prompt for it

@rekram1-node

Okay, now I understand the problem. opencode auth login provides a dialog to specify the instance URL, but when you do /connect, opencode bypasses the auth plugin's prompts and goes directly to gitlab.com, unless you specified GITLAB_INSTANCE_URL environment variable. This needs to be added to Opencode codebase, not to auth plugins. @rekram1-node Do you want me to open an issue to implement this?

I close this issue, I don't have access to the endpoint.

Navigation Menu

Repository navigation

Gitlab duo provider is not working with Self Hosted instances. #8655

Description

Plugins

OpenCode version

Steps to reproduce

Screenshot and/or share link

Operating System

Terminal

28 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Gitlab duo provider is not working with Self Hosted instances. #8655

Description

Description

Plugins

OpenCode version

Steps to reproduce

Screenshot and/or share link

Operating System

Terminal

Activity

github-actions commented on Jan 15, 2026

gaetan-puleo commented on Jan 15, 2026

vglafirov commented on Jan 15, 2026

gaetan-puleo commented on Jan 15, 2026

NicFontana commented on Jan 15, 2026

vglafirov commented on Jan 15, 2026

gaetan-puleo commented on Jan 15, 2026

gaetan-puleo commented on Jan 15, 2026

gaetan-puleo commented on Jan 15, 2026

gaetan-puleo commented on Jan 15, 2026

vglafirov commented on Jan 15, 2026

vglafirov commented on Jan 15, 2026

gaetan-puleo commented on Jan 15, 2026

28 remaining items

plutowang commented on Jan 19, 2026

NicFontana commented on Jan 19, 2026

J4NS-R commented on Jan 19, 2026

vglafirov commented on Jan 19, 2026

NicFontana commented on Jan 19, 2026

vglafirov commented on Jan 19, 2026

vglafirov commented on Jan 19, 2026

Pipyakas commented on Jan 21, 2026

vglafirov commented on Jan 21, 2026

calebdw commented on Jan 21, 2026

vglafirov commented on Jan 21, 2026

rekram1-node commented on Jan 21, 2026

vglafirov commented on Jan 22, 2026

gaetan-puleo commented on Jan 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions