🦊

Developer Tools

GitLab (Secret Token) Webhooks

DevOps platform with Git repos, CI/CD, and project management. Receive events for pushes, merge requests, pipelines, and more. Uses GitLab's legacy Secret Token auth — see "GitLab (Signing Token)" for the mode GitLab now recommends for new webhooks.

Signature Verified Auto Retries & Replay Transforms

Connecting GitLab (Secret Token) to Hookbase

Create a source in Hookbase first — it gives you an ingest URL to paste into GitLab (Secret Token). Then:

1Go to your GitLab project → Settings → Webhooks and click "Add new webhook"
2Paste your Hookbase ingest URL into the URL field
3Paste the Hookbase-generated secret into the Secret token field
4Select the trigger events and click "Add webhook"
5Use Test → Push events on the saved webhook to confirm delivery

GitLab (Secret Token) webhook docs GitLab (Secret Token) website

Signature verification

Verified by Hookbase

Set the source's provider to gitlab and paste the signing secret. Every request is checked before the event is stored, and anything that fails is rejected rather than quietly recorded.

Algorithm: Plain token echo (X-Gitlab-Token header) — not a signature. GitLab marks this mode "not recommended for new webhooks."
Header: X-Gitlab-Token
Where to find the secret: GitLab project → Settings → Webhooks → Secret token (paste the Hookbase-generated value; GitLab doesn't generate it)

GitLab (Secret Token) event types

7 of the events people route most often. Hookbase accepts every event GitLab (Secret Token) sends, whether or not it is listed here.

Push Hook

Commits pushed to a branch

Merge Request Hook

Merge request created, updated, or merged

Pipeline Hook

CI/CD pipeline status changed

Issue Hook

Issue created, updated, or closed

Tag Push Hook

Tag created or deleted

Job Hook

CI/CD job status changed

Note Hook

Comment added to an issue, MR, or commit

What a GitLab (Secret Token) webhook looks like

A Push Hook payload. Hookbase stores the raw body exactly as it arrived, so this is also what you get back on a replay.

{
  "object_kind": "push",
  "event_name": "push",
  "ref": "refs/heads/main",
  "user_name": "Example User",
  "project": {
    "id": 123,
    "name": "my-project",
    "web_url": "https://gitlab.com/user/my-project"
  },
  "commits": [
    {
      "id": "abc123",
      "message": "Update README",
      "author": {
        "name": "Example User"
      }
    }
  ],
  "total_commits_count": 1
}

Start receiving GitLab (Secret Token) webhooks

Create a source, paste the URL into GitLab (Secret Token), and watch the first event arrive. The free tier includes 1,000 events a month.

Get Started Free

Connecting GitLab (Secret Token) to Hookbase

Create a source in Hookbase first — it gives you an ingest URL to paste into GitLab (Secret Token). Then:

1Go to your GitLab project → Settings → Webhooks and click "Add new webhook"

2Paste your Hookbase ingest URL into the URL field

3Paste the Hookbase-generated secret into the Secret token field

4Select the trigger events and click "Add webhook"

5Use Test → Push events on the saved webhook to confirm delivery

Signature verification

Verified by Hookbase

Set the source's provider to gitlab and paste the signing secret. Every request is checked before the event is stored, and anything that fails is rejected rather than quietly recorded.

Algorithm: Plain token echo (X-Gitlab-Token header) — not a signature. GitLab marks this mode "not recommended for new webhooks."
Header: X-Gitlab-Token
Where to find the secret: GitLab project → Settings → Webhooks → Secret token (paste the Hookbase-generated value; GitLab doesn't generate it)

GitLab (Secret Token) event types

7 of the events people route most often. Hookbase accepts every event GitLab (Secret Token) sends, whether or not it is listed here.

Push Hook

Commits pushed to a branch

Merge Request Hook

Merge request created, updated, or merged

Pipeline Hook

CI/CD pipeline status changed

Issue Hook

Issue created, updated, or closed

Tag Push Hook

Tag created or deleted

Job Hook

CI/CD job status changed

Note Hook

Comment added to an issue, MR, or commit

What a GitLab (Secret Token) webhook looks like

A Push Hook payload. Hookbase stores the raw body exactly as it arrived, so this is also what you get back on a replay.

{ "object_kind": "push", "event_name": "push", "ref": "refs/heads/main", "user_name": "Example User", "project": { "id": 123, "name": "my-project", "web_url": "https://gitlab.com/user/my-project" }, "commits": [ { "id": "abc123", "message": "Update README", "author": { "name": "Example User" } } ], "total_commits_count": 1 }