> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Provider Authentication

> Authenticate GitHub, GitLab, Bitbucket, Azure DevOps, or AWS CodeCommit and configure the webhooks Review needs

Review supports GitHub, GitLab, Bitbucket, Azure DevOps, and AWS CodeCommit. This page covers each provider's authentication options and the manual webhook step some providers require.

## Prerequisites

* Permission to install apps, create access tokens, or create IAM roles for your organization
* The Review setup wizard open at the authentication step — see [Review setup](/guide/code-review/setup)

## GitHub

Click **Install GitHub App** to begin the GitHub App installation.

GitHub redirects you to select an organization and grant repository access. After you authorize, the wizard resumes automatically. Webhooks are registered by the GitHub App — no manual webhook configuration is needed.

<Note>
  Installing CloudThinker to a GitHub organization requires **Organization Owner** permissions. If you are not an owner, ask an owner to install the app.
</Note>

## GitLab

<Tabs>
  <Tab title="OAuth">
    Click **Connect to GitLab** to authenticate via OAuth. This is the simplest option for GitLab.com users.

    After connecting, [configure a webhook manually](#configure-webhooks).
  </Tab>

  <Tab title="Access token">
    Use a **Project Access Token** or **Group Access Token** for self-hosted GitLab instances or if you prefer manual token management. Comments then appear from a bot user, tokens stay scoped to specific projects or groups, and access is easy to revoke. CloudThinker supports self-hosted GitLab **version 12.0 and above**.

    **Connection details:**

    1. **GitLab URL**: Enter `https://gitlab.com` for GitLab.com, or your self-hosted instance URL (e.g., `https://gitlab.example.com`)
    2. **Token Type**: Select **Project Access Token** (single project) or **Group Access Token** (all projects in a group)
    3. **Access Token**: Paste your generated token

    <Accordion title="How to create a Project Access Token">
      1) Go to your project → **Settings** → **Access Tokens**
      2) Click **Add new token**
      3) Set role to `Developer` or higher
      4) Select scope: `api`
      5) Set an expiration date (recommended)
      6) Copy the generated token
    </Accordion>

    <Accordion title="How to create a Group Access Token">
      1. Go to your group → **Settings** → **Access Tokens**
      2. Click **Add new token**
      3. Set role to `Developer` or higher
      4. Select scope: `api`
      5. Set an expiration date (recommended)
      6. Copy the generated token
    </Accordion>

    <Note>
      The token must have **Developer** role or higher to post code review comments. Guest and Reporter roles cannot comment on merge requests.
    </Note>

    After connecting, [configure a webhook manually](#configure-webhooks).
  </Tab>
</Tabs>

## Bitbucket

<Tabs>
  <Tab title="OAuth">
    Click **Connect to Bitbucket** to authenticate via OAuth. Bitbucket redirects you to authorize workspace access.

    Webhooks are registered automatically — no manual webhook configuration is needed.
  </Tab>

  <Tab title="Access token">
    Connect using a Bitbucket access token. Choose the token type that matches your access level:

    | Token Type                  | Scope                           | Plan Required |
    | --------------------------- | ------------------------------- | ------------- |
    | **Workspace Access Token**  | All repositories in a workspace | Premium       |
    | **Project Access Token**    | All repositories in a project   | Premium       |
    | **Repository Access Token** | Single repository only          | Free          |

    **Connection details:**

    1. **Token Type**: Select the token scope from the dropdown
    2. **Bitbucket Workspace**: Enter your workspace slug (from the URL: `bitbucket.org/<workspace>/repo`)
    3. **Repository Slug** (Repository tokens only): Enter the repository slug
    4. **Access Token**: Paste your generated token

    Click **Validate Token** first to verify access, then click **Connect** to complete.

    **Required token permissions:**

    * Account: Read
    * Repositories: Read, Write
    * Pull requests: Read, Write
    * Webhooks: Read and write
    * Pipelines: Read, Write

    <Accordion title="How to create a Workspace Access Token">
      1. Go to **Workspace** → **Settings** → **Access tokens**
      2. Click **Create workspace access token**
      3. Enable the required permissions listed above
      4. Set an expiration date (recommended)
      5. Copy the generated token
    </Accordion>

    <Accordion title="How to create a Project Access Token">
      1. Go to **Project** → **Project settings** → **Access tokens**
      2. Click **Create project access token**
      3. Enable the required permissions listed above
      4. Set an expiration date (recommended)
      5. Copy the generated token
    </Accordion>

    <Accordion title="How to create a Repository Access Token">
      1. Go to **Repository** → **Repository settings** → **Access tokens**
      2. Click **Create Repository Access Token**
      3. Enable the required permissions listed above
      4. Set an expiration date (recommended)
      5. Copy the generated token
    </Accordion>

    Webhooks are registered automatically — no manual webhook configuration is needed.
  </Tab>
</Tabs>

## Azure DevOps

Azure DevOps uses a **Personal Access Token (PAT)** for authentication.

**Connection details:**

1. **Organization URL**: Enter your Azure DevOps organization URL (e.g., `https://dev.azure.com/your-org` or `https://your-org.visualstudio.com`)
2. **Project**: Enter the project name containing your repositories
3. **Personal Access Token**: Paste your generated PAT

Click **Validate PAT** first to verify access, then click **Connect** to complete.

**Required PAT scopes:**

* `Build` — Read
* `Code` — Read & Write
* `Pull Request Threads` — Read & Write

<Accordion title="How to create a PAT">
  1. Go to **Azure DevOps** → **User Settings** (top-right) → **Personal Access Tokens**
  2. Click **New Token**
  3. Set the organization and expiration date
  4. Select the scopes listed above
  5. Click **Create** and copy the generated token
</Accordion>

PATs expire on the date you set during creation. Rotate your PAT before it expires to avoid disrupting reviews.

After connecting, [configure webhooks manually](#configure-webhooks).

## AWS CodeCommit

CloudThinker connects to AWS CodeCommit with an **IAM role** (recommended) or an **IAM access key**. The setup wizard generates the exact policies and commands for both options.

<Tabs>
  <Tab title="IAM role (recommended)">
    The wizard provides a trust policy scoped to CloudThinker with a unique external ID, plus the AWS CLI commands to create the role.

    1. Follow the wizard's guided steps to save the generated trust policy and permissions policy files.
    2. Run the provided `aws iam create-role` and `aws iam put-role-policy` commands.
    3. Copy the role ARN and paste it into the connection form.

    The permissions policy grants read access to repositories and pull requests, permission to post and update review comments, and permission to manage the CloudThinker-prefixed EventBridge rules used for change notifications.
  </Tab>

  <Tab title="Access key">
    The wizard provides a script that creates a dedicated IAM user with the same CodeCommit permissions and generates an access key pair.

    Run the script — or follow the equivalent manual steps shown in the wizard — then paste the access key ID and secret access key into the connection form.
  </Tab>
</Tabs>

After connecting, [configure webhooks manually](#configure-webhooks).

## Configure webhooks

GitHub and Bitbucket register webhooks automatically — no action is needed. GitLab, Azure DevOps, and AWS CodeCommit require manual webhook configuration:

<Tabs>
  <Tab title="GitLab">
    After connecting your GitLab account, configure a webhook in your GitLab project or group:

    1. Go to your project/group → **Settings** → **Webhooks**
    2. Paste the webhook URL shown in the setup wizard
    3. Enter the secret token provided
    4. Enable these triggers:
       * **Merge request events**
       * **Comments**
       * **Pipeline events**
    5. Click **Add webhook**
  </Tab>

  <Tab title="Azure DevOps">
    After connecting your Azure DevOps project, create **4 separate service hooks** in Azure DevOps:

    1. Go to **Project Settings** → **Service hooks**
    2. Click **Create subscription** and select **Web Hooks**
    3. Create one hook for each of these events:
       * **Pull request created**
       * **Pull request updated**
       * **Pull request commented on**
       * **Build completed**
    4. For each hook, paste the webhook URL shown in the setup wizard
    5. Use **Basic authentication** with the secret token as the password (leave username empty)
  </Tab>

  <Tab title="AWS CodeCommit">
    The setup wizard provides a script that wires Amazon EventBridge to CloudThinker for every CodeCommit repository in your chosen region:

    1. Copy the script from the wizard — it embeds your webhook URL and secret token
    2. Run it with AWS CLI credentials for the account that owns the repositories
    3. Return to the wizard and mark the webhook as configured

    The script is safe to re-run — run it again after adding new repositories to the region.
  </Tab>
</Tabs>

## Next steps

<CardGroup cols={2}>
  <Card title="Review setup" icon="gear" href="/guide/code-review/setup">
    Select repositories, choose a review mode, and finish the setup wizard
  </Card>

  <Card title="Mention commands" icon="at" href="/guide/code-review/mention-commands">
    Interact with CloudThinker directly from PR and MR comments
  </Card>
</CardGroup>