**What is ROPC and why does it matter?** Resource Owner Password Credentials (ROPC) is an older, less secure method for applications to authenticate with GitLab. Instead of using modern security practices, it requires users to share their passwords directly with third-party applications. This creates significant security risks: passwords can be stolen, misused, or exposed in logs. **Why are we removing it?** Modern authentication standards have evolved to eliminate the need for password sharing. Newer methods (like OAuth authorization codes) are more secure because users never share passwords with applications. Removing ROPC reduces our attack surface and protects customer data. **What's the timeline?** * **(18.3+):** New applications on GitLab.com cannot use ROPC * **18.4-18.5:** Existing applications on GitLab.com will be disabled from using ROPC * **19.0 (May 2026):** ROPC is completely removed from Self-Managed instances * **Customer communication:** Self-Managed customers will be notified directly by their Customer Success Managers before removal **Impact:** Customers using ROPC will need to migrate to modern authentication methods. We're providing advance notice and communication to minimize disruption. **Success Criteria:** * Identified customers using ROPC are notified via CSM communications * Migration path is communicated for affected users * Zero production incidents from removal --- This is a container epic for the gradual deprecation of password resource grant type OAuth flow, once we have adequate migration option available for users. - https://gitlab.com/gitlab-org/gitlab/-/issues/323615+: To implement a setting that can be enabled/disabled by users for the grant type to be usable or not in their instances. This allows folks who'd like to opt out the legacy functionality sooner than 18.0 can do so - https://gitlab.com/gitlab-org/gitlab/-/issues/457353+: To announce to users that we will be default disabling the setting added above in 19.0 as it's a breaking change - https://gitlab.com/gitlab-org/gitlab/-/issues/457352+: The small change to set the setting as default disabled on SM and .com in 19.0 ### Revised proposal The plan below tracks agreed upon scope within ~CY items - New OAuth applications cannot use ROPC on GitLab.com :white_check_mark: - Modify implementation to not allow ROPC at all on GitLab.com. The existing setting allow SM admins to require client credentials through `Allow ROPC with client credentials` will stay as-is until 19.0. This way we remove the flow from .com, while keeping it for SM. - Communicate with CSMs of SM users to inform them of the upcoming deprecations/removal of ROPC for SM as well in 19.0 - Remove ROPC and the setting completely in 19.0. This has already been announced in the [deprecation notice](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/189086/diffs)