Breadcrumbs

Install Mend Developer Platform for GitLab.com

Overview

In this article, you will find step-by-step instructions for installing the Mend Developer Platform for Bitbucket Cloud.

Getting it done

Prerequisites

  • Access to a Paid GitLab account. Free accounts are not currently supported.

  • Access to a GitLab Group and a user with Admin privileges

  • If your Group has conditional access to certain IP addresses, add the IP addresses listed under “developer-platform” in this file to your allowlist.

Also, for paid Mend customers only:

  • Mend Account with SCA/SAST entitlement on the Mend AppSec Platform

  • Admin Access to Mend AppSec Platform to generate Activation Key

Notes:

  • You should have access to the Mend Platform only if you wish to unlock all the premium features, such as SCA and SAST. If you solely intend to utilize Renovate, there is no need to create a Mend account.

  • This integration is not supported for organizations configured on the Mend EU environment.

  • A GitHub.com token is recommended for running scans. Without it, GitHub release notes won’t be retrieved, which will result in a warning message.

Installing Mend Developer Platform for GitLab

Note: The GitLab user who will onboard the organization will be the one that will be used to create commit statuses, issues, and PRs from their own account. We recommend creating a dedicated user solely dedicated to the integration with the Mend Developer Platform, and proceeding with the rest of the installation steps with the dedicated user.

  1. Log in to the Mend Developer Portal and authorize with your GitLab user.

  2. Complete the Mend Registration step and click CONTINUE.

    image-20250929-025009.png

  3. After registration is completed, you’ll be navigated to the Mend Developer Platform main dashboard.

Renovate-only: Users of the free Renovate-only plan should skip to step 5.
Paid Mend.io customers: Follow all steps below.

  1. Obtain the GitLab license key:

    1. Log into the Mend AppSec Platform

    2. Navigate to Profile --> Integrations

    3. Click the GitLab.com card

      image-20260324-132711.png

    4. Click Get Activation Key

      image-20260324-132824.png

  2. In the Mend Developer Portal, click on “Install more” to install Mend Renovate or Mend Developer Platform in your GitLab project(s):

    image-20260309-202012.png

  3. Select your GitLab group(s) that you want to integrate with Mend.
    Pay attention to the + Load More button which will be visible when there are more than twenty subgroups to choose from.

    image-20260309-202130.png

  4. A pop-up window will appear asking you to accept a redirection to GitLab to authenticate and install the Mend integration for the selected project(s).
    Note: You will only need to complete this step once. The user's refresh token will also be used for future onboarding.

  5. The Setup Wizard will open, where two product options will be presented.

    image-20260309-202432.png

    Renovate-only users: Choose Renovate only, then skip to step 11.
    Paid Mend customers: Choose Mend Application Security, then continue to follow all steps.

  6. Using the Activation Key copied from the Mend AppSec Platform, paste the Activation Key into the Mend Activation Key box to connect your Azure DevOps organization with your paid Mend account.

    image-20260309-202533.png

  7. Click Connect groups, and then Next.
    You’ll see the name of the Mend Organization that your organization is now connected to.

  8. Now you have the option to activate the Mend App for all repositories or only selected repositories. Select your preference, and then click Next.

    image-20260309-202628.png

During the installation process, please note that the Mend Developer Platform app is installed for the entire group. This means that it will have access to all repositories within the group, regardless of the repositories selected during installation.
Selecting repositories at this step defines which will have the available engines enabled and activated.

  1. Choose your preferred mode for the selected repositories, and then click Next.

    image-20260309-202719.png

  2. Click Finish to complete the installation steps for Mend Renovate and Mend Developer Platform.

    image-20260309-202819.png


Group Settings

This is the page accessible to the GitLab GroupAdmin, where you can link or unlink a connection to a Mend Organization.

When selecting CHANGE MEND ORG, a pop-up window will appear asking you to insert the activation key of the organization you would like to connect.

image-20251217-165321.png
image-20251217-165339.png

Refresh Token

Mend uses the Refresh Token to create items in the repository on behalf of the onboarded user who installed the integration.

In case you are the user who onboarded projects with the Mend Developer Platform integration, you will find in your Profile Settings page the list of those projects.

Notes:

  • You can remove integration for specific groups or delete the refresh token. Note that removing the refresh token will cause all groups that were onboarded with this user to uninstall the integration. The same will happen if this user deletes their account on this page.

  • GitLab group admins can remove any group in their organization from the Mend Developer Platform.

  • If you would like to pass the role of dedicated user to another user, you’ll need to uninstall all or selected groups, and then the new user should re-onboard them. In this case, the group’s configuration and repos will be preserved, and the app will continue working under a new dedicated user.

Limitations

  1. You can connect multiple source code management (SCM) systems to a single organization in the Mend AppSec Platform, with the following caveats:

  1. If you have multiple SCMs connected to your organization in the Mend AppSec Platform, to switch between them you must first sign out of the Developer Platform, then select a different SCM on your next sign-in. Example:

    1. Sign in with GitHub to see your GitHub organizations

    2. Sign out

    3. Sign back in with Azure DevOps to see your Azure DevOps projects

  2. The Developer Platform is currently not supported for organizations hosted in India

  3. Basic Renovate configuration is available under the Dependencies section of the Developer Platform. For the full Renovate documentation visit https://docs.renovatebot.com/