Skip to main content
On-premisesGitHubGitLabBitbucket Data CenterAzure DevOpsGerrit
Use invite-only mode to restrict human-triggered Qodo Code Review to specified Git identities. Only identities on the allowlist can trigger a review. This does not control who can open a pull request or sign in to the Qodo portal.

​
Before you start

Connect your Git provider and confirm that Qodo Code Review uses CONFIG__IDENTITY_PROVIDER=default. This is the review identity provider, separate from your portal’s SSO provider. You can keep your existing SSO configuration, including Zitadel. With the default review identity provider, the allowlist check does not require portal invitations, per-user Git account linking, or Firestore records. Adding an identity to the list does not create a portal account or grant repository access.

​
Choose the Git provider

The integration determines which identity is checked for each event. For example, an allowed GitHub user can request a review on someone else’s PR. An unlisted user requesting a review on an allowed author’s PR is skipped. For Bitbucket Cloud integrations, confirm the effective identity with Qodo before using this setting. Events can supply a display name instead of a unique username.

​
Configure the allowlist

1

Add settings to your Helm values

Add both settings to your deployment’s Helm values, preserving any existing entries under global.merge.settings:
values.yaml
Keep both values as YAML strings. CONFIG__ALLOWED_USERS contains a JSON array of strings. Matching ignores case and uses the identity supplied by the Git integration. Use the values described below rather than a portal display name.These settings are centrally managed. Repository .pr_agent.toml overrides for invite_only_mode and allowed_users are ignored.
2

Apply the updated values

Apply the updated values using your existing Helm upgrade process and wait for the review workloads to roll out.
3

Confirm the configuration

Confirm that an identity on the allowlist can trigger a review and an identity not on the allowlist is skipped. For more information, see Deploy Qodo using Helm.
When invite-only mode is enabled, an empty or invalid allowlist blocks human users. Setting the allowlist alone does not enable the restriction.GitHub bot senders can bypass the allowlist when bot reviews are enabled with github_app.ignore_bot_pr=false, including through a repository’s .pr_agent.toml. For a rollout limited to listed human identities, keep bot reviews disabled in both deployment and repository settings.

​
Disable invite-only mode

  • In your Helm charts, Set CONFIG__INVITE_ONLY_MODE to "false" and apply the update. You can then remove CONFIG__ALLOWED_USERS if it is no longer needed. For more information, see Helm chart configuration reference.