'%3e%3cpath%20d='M904%200H120C53.7258%200%200%2053.7258%200%20120V904C0%20970.274%2053.7258%201024%20120%201024H904C970.274%201024%201024%20970.274%201024%20904V120C1024%2053.7258%20970.274%200%20904%200Z'%20fill='%23050816'/%3e%3cpath%20d='M430%20190L390%20135'%20stroke='%238B5CF6'%20stroke-width='28'%20stroke-linecap='round'/%3e%3cpath%20d='M512%20165V95'%20stroke='%238B5CF6'%20stroke-width='28'%20stroke-linecap='round'/%3e%3cpath%20d='M594%20190L634%20135'%20stroke='%238B5CF6'%20stroke-width='28'%20stroke-linecap='round'/%3e%3cpath%20d='M512%20250C380%20250%20320%20350%20320%20500V620C320%20720%20260%20790%20220%20840H804C764%20790%20704%20720%20704%20620V500C704%20350%20644%20250%20512%20250Z'%20stroke='white'%20stroke-width='26'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cpath%20d='M430%20840C430%20900%20470%20940%20512%20940C554%20940%20594%20900%20594%20840'%20stroke='white'%20stroke-width='26'%20stroke-linecap='round'/%3e%3cpath%20d='M566%20410V700'%20stroke='white'%20stroke-width='22'%20stroke-linecap='round'/%3e%3cpath%20d='M566%20418C581.464%20418%20594%20405.464%20594%20390C594%20374.536%20581.464%20362%20566%20362C550.536%20362%20538%20374.536%20538%20390C538%20405.464%20550.536%20418%20566%20418Z'%20fill='%23050816'%20stroke='white'%20stroke-width='18'/%3e%3cpath%20d='M566%20748C581.464%20748%20594%20735.464%20594%20720C594%20704.536%20581.464%20692%20566%20692C550.536%20692%20538%20704.536%20538%20720C538%20735.464%20550.536%20748%20566%20748Z'%20fill='%23050816'%20stroke='white'%20stroke-width='18'/%3e%3cpath%20d='M412%20533C412%20580.124%20412%20623.288%20412%20670.361L412%20723H485'%20stroke='%238B5CF6'%20stroke-width='22'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cpath%20d='M464%20698L506%20723L464%20748'%20stroke='%238B5CF6'%20stroke-width='15'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cpath%20d='M412%20533C427.464%20533%20440%20520.464%20440%20505C440%20489.536%20427.464%20477%20412%20477C396.536%20477%20384%20489.536%20384%20505C384%20520.464%20396.536%20533%20412%20533Z'%20fill='%23050816'%20stroke='%238B5CF6'%20stroke-width='18'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_401_2'%3e%3crect%20width='1024'%20height='1024'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Installation
GitLab Self-Hosted
Connect MergeMe to your own GitLab instance. MergeMe cannot reach your GitLab server inbound - your instance sends webhook events outbound to https://api.mergeme.dev. Register webhooks in GitLab either once per group that owns your projects (recommended) or once per project individually.
Prerequisites
- A MergeMe account (sign in at mergeme.dev with Google)
- Maintainer or Owner access on the GitLab groups or projects you want to track
- A Slack workspace where notifications should appear
- Outbound HTTPS from your GitLab instance to
api.mergeme.devon port 443 (see network requirements)
Setup
Create a workspace
Sign in and create a workspace from onboarding. You can pick Self-hosted GitLab as your starting provider (MergeMe enables self-hosted credentials automatically), or choose GitHub/GitLab.com and enable self-hosted later from the dashboard.
Connect Slack
In the sidebar, open Sources > Slack and click Connect Slack. Authorise the MergeMe bot in your Slack workspace.
Enable self-hosted GitLab and copy credentials
Open Sources > Self-hosted. If this is your first time, click Yes, use self-hosted GitLab (owners and admins only). MergeMe generates:
- Webhook URL -
https://api.mergeme.dev/webhooks/gitlab/<workspaceId> - Signing token (recommended, GitLab 19.0+)
- Secret token (fallback for GitLab 18.x and earlier)
Use Regenerate tokens if you need new values - you must update every GitLab webhook that uses them.
Register webhooks in GitLab
Paste the same MergeMe URL and tokens into GitLab. The dashboard setup checklist assumes a group webhook; per-project webhooks work too if you prefer.
- Per group (GitLab Premium or Ultimate, recommended): group > Settings > Webhooks. Events from projects in that group and its subgroups are sent to MergeMe. Map only the project IDs you need in Channel Mappings. See GitLab group webhooks.
- Per project: each project > Settings > Webhooks. Repeat for every project you want to track.
For each webhook you add:
- Paste the Webhook URL into the URL field (must start with
https://) - Paste the Signing token (GitLab 19.0+) or Secret token (older GitLab)
- Enable Merge request events and Comments (on some GitLab versions this appears as Note events)
- Leave SSL verification enabled
- Click Add webhook
Add channel mappings
Open Routing > Channel mappings. For each self-hosted project, enter the GitLab project ID (under Settings > General in GitLab), pick a Slack channel, and save. Events from unmapped projects are ignored.
Map users (optional)
Open Routing > User mappings. For each GitLab username, select the corresponding Slack user for @-mention resolution.
Network requirements
Your self-hosted GitLab instance cannot be fully air-gapped. When GitLab delivers a webhook, it makes an outbound HTTPS POST to https://api.mergeme.dev/webhooks/gitlab/<workspaceId> on port 443. MergeMe never connects inbound to your GitLab server - traffic is always GitLab > MergeMe. Allow outbound HTTPS to api.mergeme.dev through your firewall or proxy.
Signing token vs secret token
GitLab 19.0 introduced signing tokens - an HMAC-SHA256 signature over the request body, with a timestamp to prevent replays. This is more secure than the older secret token, which sends a plain value in a header with no body integrity check.
| Signing token | Secret token | |
|---|---|---|
| GitLab version | 19.0+ | All versions |
| What's sent | HMAC-SHA256 signature | Plain secret value |
| Body integrity | Yes | No |
| Replay protection | Yes (5 min window) | No |
Use the signing token if your GitLab version is 19.0 or later. Use the secret token as a fallback for older instances. MergeMe checks for the signing token first and falls back to the secret token automatically.
Troubleshooting
Webhook test fails in GitLab - Confirm your GitLab instance can reach https://api.mergeme.dev on port 443. Check firewall, proxy, and SSL verification settings. Some self-hosted instances block outbound HTTPS.
No Slack message after merging an MR - Confirm Merge request events are enabled on the GitLab webhook and the project ID in Channel Mappings matches GitLab exactly.
Comments not appearing in Slack - Confirm Comments (or Note events on older GitLab) is enabled on the webhook.