Git OAuth and webhooks

Bundles rely on read access to your repositories. Loopback integrates GitHub and GitLab through organization-level OAuth application routes and system ingress webhooks that receive push and pipeline events.

OAuth applications (organization)

Organization routes configure GitHub and GitLab OAuth clients:

• Application ids, secrets, and self-hosted base URLs (GitLab, GitHub Enterprise patterns) stored as integration metadata.
• Used when users authorize Loopback to clone and scan repositories for bundle discovery.

Secrets are stored by reference; never embed long-lived tokens in client-side code.

Webhooks (system ingress)

The API mounts ingress handlers for:

• GitHub push and workflow events.
• GitLab pipeline and push hooks.
• Flux CD-style notifications where enabled.

Webhooks correlate external activity with bundle discovery, build, and deploy state machines. Exact HMAC validation and URL paths are deployment-specific; your operator publishes the public endpoint base.

Buyer checklist

• Confirm which Git host editions are supported (github.com, GitLab SaaS, self-managed).
• Map egress from Loopback workers to your Git IP allow lists.
• Require least privilege OAuth scopes for repository read-only automation.

Related reading

• Bundles overview
• Bundles operations
• Service providers and ecosystems
• Technical verification