Skip to main content
Lettuce ships three first-class git-provider integrations: GitHub App, GitLab OAuth, and Bitbucket OAuth. As the admin connecting your organization to Lettuce, you’ll see the same shape for all three — Connect → authorize → pick repos → done. This page is the one-screen map of what each provider asks for and what Lettuce does with it. Each per-provider page walks you through the click-by-click connect flow.

​
Two ways to add a repo

The two paths coexist. Even with all three providers connected, the Other (paste URL) tab in the Add-repo dialog stays available for the long tail.

​
Shared per-account webhook secret

All three providers point at one URL per account, signed by one secret per account:
The secret is auto-generated the first time your account adds a repo (or opens the Webhook card under Account settings). Lettuce stores it once and reuses it for every repo on every provider — so adding a fourth repo to your GitHub install doesn’t generate yet another secret to copy around. Signature schemes differ: Lettuce verifies the appropriate header for each delivery before doing any work, so a forged delivery is rejected with 401.

​
Scopes at a glance

Lettuce never asks for write access to your code. The GitLab write_repository scope is a quirk of GitLab’s permission model — it’s needed only because the webhook-registration API is gated by it. We don’t push commits.

​
Token lifecycle

If you (or another admin on your team) revoke Lettuce on the provider side, or the upstream rotates secrets, the Add-repo dialog and the Settings → Connected integrations row both surface a Reconnect prompt instead of failing the whole add-repo flow.

​
Disconnect

Owners can disconnect any provider from Settings → Connected integrations. Existing repos keep their git URLs:
  • Public repos still re-clone on schedule.
  • Private repos break until you reconnect (Lettuce no longer has a token to mint a clone URL).
Disconnect is non-destructive on the provider side — Lettuce simply forgets the OAuth grant. To fully revoke, also remove the App or OAuth grant from your GitHub / GitLab / Bitbucket settings.

​
Per-provider setup

  • GitHub App — install the Lettuce GitHub App on your org, pick repos.
  • GitLab OAuth — authorize Lettuce on your GitLab account, pick projects.
  • Bitbucket OAuth — grant Lettuce access on Bitbucket, pick repos across workspaces.
Self-hosted admin note. If you run Lettuce inside your own infrastructure, the one-time registration of each provider’s App / OAuth client lives in Self-hosted install (§5). On Lettuce Cloud you don’t have to think about that — the per-provider pages below describe what an org admin clicks through on the SaaS.