How to Use GitLab Duo in Intellij
To learn how to use GitLab Duo in IntelliJ, install the official plugin and log in. You link your editor to your account with a personal token or OAuth flow. Most teams set up this tool by handing out broad access tokens to developers. When roles and token scopes are too wide, the editor holds excess privileges. A leaked local token can expose source code and project settings across many groups. How to use GitLab Duo in IntelliJ step by step First, make sure your user account has a valid seat
Just-in-Time Access + GitLab CI Security: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To learn how to use GitLab Duo in IntelliJ, install the official plugin and log in. You link your editor to your account with a personal token or OAuth flow. Most teams set up this tool by handing out broad access tokens to developers. When roles and token scopes are too wide, the editor holds excess privileges. A leaked local token can expose source code and project settings across many groups.
How to use GitLab Duo in IntelliJ step by step
First, make sure your user account has a valid seat assigned by an admin. Without an active seat, the editor plugin will not return code hints or chat replies. Next, open the IntelliJ marketplace view and search for the official GitLab plugin. Install the plugin into your local editor and restart the app if needed.
Once the plugin loads, you must link it to your remote server or cloud account. You can log in with a browser OAuth prompt or paste a personal token. When you create a token, pick only the minimum scope required for AI features. The editor stores this credential in its local key store on your machine.
After you log in, check the status icon at the bottom of your editor window. The icon shows if the AI assistant is ready to read your open files. As you write code, the plugin sends file context to the remote model. The model sends back inline code suggestions and answers questions in a chat pane. You can accept a hint with a key press or ask the chat to fix bugs.
Managing token scopes and workspace access
Team admins can manage AI settings at the group or project level. If a project holds secret logic, admins can turn off AI features for that repo. The editor checks these group rules before it sends file fragments to the remote service. You can also add local ignore rules to keep certain files out of context.
Still, developers often link their editor to databases and cloud servers during the same coding session. They test code generated by the AI against real systems using local credentials. If a developer pastes live query outputs into the chat, sensitive fields travel to the model. Emails, phone numbers, card numbers, and national IDs can end up in external prompts.
Just-in-Time Access + GitLab CI Security: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What the native setup solves and what keeps the session active
The native plugin setup solves how developers get inline code help inside IntelliJ. Account seats and group toggles control who can turn on the assistant. Project rules also help block specific code repos from interacting with the model.
Still, the native setup only governs the link between the editor and the source host. It does not control how developers or local tools run commands against live data stores. Once a user logs in to a database or cloud host from IntelliJ, native AI settings stop working. The editor setup decides who logs in to the code host. It does not inspect individual queries, commands, or requests sent to backend systems in flight. Teams still face the risk of static credentials sitting on laptops and unreviewed commands hitting production.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Why are code suggestions not showing up in IntelliJ?
Check that your admin assigned a seat to your user profile. Also verify that your personal token is still active and that the project allows AI features.
Can I use the plugin with a self-managed server?
Yes, the plugin supports both cloud accounts and self-managed instances. You just enter your custom server URL when you log in inside the plugin settings.
How do I stop the plugin from reading specific files?
You can turn off the assistant for an entire project in the remote settings. You can also configure exclusion rules so the plugin skips matching file paths.