Where the authorization list lives
GitLab keeps the apps you have authorized in one account-level list. Open your profile settings, then Edit profile, then Access, then Applications. That page is your OAuth inventory: it shows the third-party applications that can act on your behalf, and the scopes each one holds.
GitLab lists authorized applications under Edit profile, Access, Applications. Source
This is not the same as project access tokens or deploy keys. Those are credentials tied to a repository or project; authorized applications are tied to your user account and may reach across it. Audit them separately so a clean OAuth list does not give false comfort about project credentials.
What the scopes tell you
Scopes describe how far an app can reach. They are not all equivalent, and you should not assume every app is read-only. An app that only reads your profile is a different risk from one holding broad API access that can write or act across your account.
Authorized applications can be revoked; their scopes can range from profile reads to broad API access. Source
The practical point: read the scope line before you decide. If you cannot explain why an app needs the access it holds, that is the app to question first.
Decision table for each authorized app
| What you see | What it means | Suggested action |
|---|---|---|
| App you recognize, scope matches its purpose, still in use | Expected authorization | Keep it; note the scope for later review |
| App you recognize but no longer use | Stale authorization | Revoke it |
| App you do not recognize at all | Unknown authorization | Investigate before revoking; check whether a colleague or integration added it |
| App with broad API scope you cannot justify | Over-broad access | Revoke or reduce; do not assume it is read-only |
| App you suspect is compromised | Active risk | Revoke promptly, then review account activity |
Self-review checklist
- Open Edit profile, Access, Applications and list every authorized app.
- For each, write one line: what it is, why it has access, and its scope.
- Revoke anything you cannot justify.
- Revoke stale apps you no longer use.
- Re-check the list after a few weeks; new authorizations can appear without a prompt you noticed.
- Keep this audit separate from project access token reviews.
Honest limits
Revoking an application ends its future access through that authorization. It does not reach into the app’s own systems and delete data already copied, exported or cached. If an app stored your profile information, revocation is not a deletion request. Treat revocation as closing a door, not as cleaning the room.
Revocation also does not make your GitLab profile private. Profile visibility and app authorization are separate settings; changing one does not change the other.
After you revoke
Your public footprint is broader than one platform’s OAuth list. Knowing which handles are publicly visible helps you decide where to look next. TraceSeek checks a username across 3,000+ platforms and returns public matches in 20-30 seconds, with a free first scan and no registration required. Those matches are leads, not proof of identity, and the app does not change platform settings or see private information. For a wider sweep, see find forgotten online accounts; for how results are framed, read our methodology.
Key facts
- GitLab lists authorized applications under Edit profile, Access, Applications.
- Authorized applications can be revoked, and their scopes can range from profile reads to broad API access.
- Revoking an authorized application does not delete data the app already copied.
- Authorized applications are account-level authorizations, separate from project access tokens.
- TraceSeek checks a username across 3,000+ platforms and returns public matches in 20-30 seconds.