> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qodo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Restrict Qodo Code Review to allowed users

> Restrict who can trigger Qodo Code Review by configuring an allowlist of Git identities.

On-premisesGitHubGitLabBitbucket Data CenterAzure DevOpsGerrit

Use invite-only mode to restrict human-triggered Qodo Code Review to specified Git identities. Only identities on the allowlist can trigger a review. This does not control who can open a pull request or sign in to the Qodo portal.

## Before you start

Connect your Git provider and confirm that Qodo Code Review uses `CONFIG__IDENTITY_PROVIDER=default`. This is the review identity provider, separate from your portal's SSO provider. You can keep your existing SSO configuration, including Zitadel.

With the default review identity provider, the allowlist check does not require portal invitations, per-user Git account linking, or Firestore records. Adding an identity to the list does not create a portal account or grant repository access.

## Choose the Git provider

| Git provider | Value to include in `CONFIG__ALLOWED_USERS` |
| - | - |
| GitHub Cloud, Enterprise Cloud, and Enterprise Server | The GitHub login from the event's `sender.login`. See [GitHub webhook payloads](https://docs.github.com/en/webhooks/webhook-events-and-payloads#pull_request). |
| GitLab Cloud and Self-Managed | The GitLab username, supplied as `user.username` for merge request and comment events. See [GitLab webhook events](https://docs.gitlab.com/user/project/integrations/webhook_events/). |
| Bitbucket Data Center | The actor's account name (`name`). If it is absent, confirm the fallback identity with Qodo for your installed integration. See [Bitbucket Data Center event payloads](https://confluence.atlassian.com/bitbucketserver/event-payload-938025882.html). |
| Azure DevOps | Qodo matches the identity's `uniqueName`, usually an email address. Qodo generally uses the creator for PR events and the comment author for comment commands. See [Azure DevOps service hook payloads](https://learn.microsoft.com/en-us/azure/devops/service-hooks/events?view=azure-devops). |
| Gerrit | The change owner's username for change events, or the comment author's username for comment commands. Restored changes use the restoring user's identity when available. See [Gerrit event types](https://gerrit-review.googlesource.com/Documentation/cmd-stream-events.html#_events). |

The integration determines which identity is checked for each event. For example, an allowed GitHub user can request a review on someone else's PR. An unlisted user requesting a review on an allowed author's PR is skipped.

For Bitbucket Cloud integrations, confirm the effective identity with Qodo before using this setting. Events can supply a display name instead of a unique username.

## Configure the allowlist

**1. Add settings to your Helm values**

Add both settings to your deployment's Helm values, preserving any existing entries under `global.merge.settings`:

```yaml values.yaml theme={null}
global:
  merge:
    settings:
      CONFIG__INVITE_ONLY_MODE: "true"
      CONFIG__ALLOWED_USERS: '["alice", "bob"]'
```

Keep both values as YAML strings. `CONFIG__ALLOWED_USERS` contains a JSON array of strings. Matching ignores case and uses the identity supplied by the Git integration. Use the values described below rather than a portal display name.

These settings are centrally managed. Repository `.pr_agent.toml` overrides for `invite_only_mode` and `allowed_users` are ignored.

**2. Apply the updated values**

Apply the updated values using your existing Helm upgrade process and wait for the review workloads to roll out.

**3. Confirm the configuration**

Confirm that an identity on the allowlist can trigger a review and an identity not on the allowlist is skipped. For more information, see [Deploy Qodo using Helm](https://docs.qodo.ai/on-prem/qodo-on-prem-helm-chart-overview.md).

> [!WARNING]
>
> When invite-only mode is enabled, an empty or invalid allowlist blocks human users. Setting the allowlist alone does not enable the restriction.
>
> GitHub bot senders can bypass the allowlist when bot reviews are enabled with `github_app.ignore_bot_pr=false`, including through a repository's `.pr_agent.toml`. For a rollout limited to listed human identities, keep bot reviews disabled in both deployment and repository settings.

## Disable invite-only mode

* In your Helm charts, Set `CONFIG__INVITE_ONLY_MODE` to `"false"` and apply the update. You can then remove `CONFIG__ALLOWED_USERS` if it is no longer needed. For more information, see [Helm chart configuration reference](https://docs.qodo.ai/on-prem/on-prem-helm-chart-reference.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.