Git providers (GitLab, Bitbucket)

FixControl supports four code hosts. GitHub has its own dedicated guide; this page covers the other three. The behaviour is the same across providers — you click Run fix on an issue, an agent produces a patch in a sandbox, and a pull/merge request is opened on the configured branch — only the auth flow differs.

GitLab

Auth choices

• OAuth (recommended) — admin signs in once, FixControl gets per-user installation context and can act on every project the admin can see.
• PAT — token-only. Simpler, but tied to a specific user account; if that user leaves, the token dies.

Self-hosted GitLab is supported — when connecting, point FixControl at your instance URL (default is https://gitlab.com).

OAuth setup

1. In GitLab: Edit profile → Applications (for an instance-wide app: Admin → Applications).
2. Name: FixControl. Redirect URI: https://<your-host>/api/auth/gitlab/callback.
3. Scopes: api, read_repository, write_repository. Confidential must be checked.
4. Save and copy the Application ID and Secret, and provide them to FixControl during the connect flow.
5. Each tenant admin clicks Settings → Integrations → GitLab → Connect and consents. The OAuth token is stored encrypted against the tenant's integration record.

PAT setup

1. Edit profile → Access Tokens → create token with scopes api, read_repository, write_repository.
2. In FixControl: Settings → Integrations → GitLab → Connect via PAT and paste the token + base URL.

What FixControl does on Run fix

• Branches off your project's default_branch.
• Pushes the patch to a branch named like fixcontrol/<issue-id>-<slug>.
• Opens a merge request, fills in title and description from the issue, links the issue ID.
• Posts back the MR URL onto the issue.

Webhooks (optional)

If you want FixControl to react to MR closes / merges, add a webhook in GitLab pointing at https://<your-host>/api/webhooks/gitlab with the events Merge request events, Push events, Note events. The signing secret is shown in FixControl on the integration page.

Bitbucket Cloud

Auth choices

• OAuth consumer (recommended) — workspace admin grants once.
• App password — per-user. Simpler for single-user setups.

OAuth consumer setup

1. Workspace settings → OAuth consumers → Add consumer.
2. Name: FixControl. Callback URL: https://<your-host>/api/auth/bitbucket/callback.
3. This is a private consumer: checked.
4. Permissions: Account Email/Read, Repositories Read/Write, Pull requests Read/Write.
5. Save and copy Key and Secret, and provide them to FixControl during the connect flow.
6. Tenant admin clicks Settings → Integrations → Bitbucket → Connect.

App password setup

1. Personal settings → App passwords → Create app password.
2. Permissions: Account Read, Repositories Read/Write, Pull requests Read/Write.
3. Copy the password (shown once) and paste it together with the Bitbucket username in FixControl.

Bitbucket Server (on-prem)

Bitbucket Server (formerly Stash) is supported via personal access tokens.

1. In Bitbucket Server: Profile → Manage account → HTTP access tokens → Create token.
2. Permissions: Project Read, Repositories Read/Write. Set an expiry that matches your rotation policy.
3. In FixControl: Settings → Integrations → Bitbucket Server → Connect, paste the base URL (e.g. https://bitbucket.internal.acme/) and the token.

Tokens scoped tighter than the permissions above will fail to push branches or open PRs.

Multiple providers per tenant

A tenant can connect any combination of providers. For example: GitHub for production repos, GitLab for an internal tools monorepo, Bitbucket Server for a legacy product. Each codebase points at exactly one provider — agents pick the right one automatically when a Run-fix runs.

Common errors

FAQ

Can a single repository use multiple providers? No — each codebase resolves to exactly one provider. If you mirror a repo across hosts, pick the canonical one and let the others sync from it externally.

Are tokens encrypted at rest? Yes. Every credential — OAuth tokens, refresh tokens, PATs, app passwords — is encrypted with AES-256-GCM before being stored.

Can I rotate without losing in-flight patches? Yes. Reconnect creates a new credential and atomically swaps it in. Patches already pushed continue normally; new patches use the new credential.