## 5.2: Migrate `access_token` by feature or use case Obtaining an access token is by far the most used feature of this API. I suggest we further sub-divide this step to incrementally lean into more complex scenarios, so as to migrate those first with less risk and complexity. We should start with those cases where seat assignments do not matter: <table> <tr> <th>Feature/Use case</th> <th>Description</th> <th>Issue</th> <th>Size</th> <th>Status</th> </tr> <tr> <td> **Group Access: GOB integration** </td> <td>This integration never went live; we could decide to just remove it, or migrate it over.</td> <td> https://gitlab.com/gitlab-org/gitlab/-/issues/538098 </td> <td>n/a</td> <td> :white_check_mark: </td> </tr> <tr> <td> **User-bound access: SAST IDE Scanner** </td> <td> We should be able to replace this with the new `Tokens` implementation since it does not use seat assignments, yet passes a `User` anyway. </td> <td> https://gitlab.com/gitlab-org/gitlab/-/issues/538100 </td> <td>M</td> <td> :white_check_mark: </td> </tr> <tr> <td> **Migrate AmazonQ away from AvailableServices** </td> <td> We should be able to replace this with the new `Tokens` implementation since it does not use seat assignments, yet passes a `User` anyway. </td> <td> https://gitlab.com/gitlab-org/gitlab/-/issues/546587 </td> <td>M</td> <td> :white_check_mark: </td> </tr> <tr> <td> **Remove all Cloud Connector "enabled" checks.** </td> <td>We have several code paths that fetch a token just to check if CC/Duo is "enabled." This is no longer needed. Token sync is now aligned with entitlements, so user.allowed_to_use is sufficient. On GitLab.com, the "enabled" check is redundant—it issues a token just to check if it should issue a token. These checks should be removed.</td> <td> https://gitlab.com/gitlab-org/gitlab/-/issues/546563 </td> <td>M</td> <td> :white_check_mark: </td> </tr> <tr> <td> **Implement Fallback Mechanism in CloudConnector::Tokens.get with performance Instrumentation** </td> <td>Implement a fallback mechanism in CloudConnector::Tokens.get that will gracefully revert to legacy token retrieval methods when needed, with comprehensive performance instrumentation and a controlled, gradual rollout strategy</td> <td> https://gitlab.com/gitlab-org/gitlab/-/issues/546576 </td> <td>M</td> <td> :white_check_mark: </td> </tr> <tr> <td> **Refactor AiGateway.headers to accept unit_primitive and use pass it to Tokens.get** </td> <td> Simplify and standardize token management by refactoring Gitlab::AiGateway.headers to exclusively use CloudConnector::Tokens.get for token retrieval. We will move scenario-by-scenario, so we expect to open many small MRs under this issue </td> <td> https://gitlab.com/gitlab-org/gitlab/-/issues/546578 </td> <td>M</td> <td> :white_check_mark: </td> </tr> <tr> <td> **Consolidate 'anthropic_proxy' UP usage and ensure service mapping for relevant UPs** </td> <td> We need to ensure 1:1 UP \<-\> service mapping for all relevant UPs used for this endpoint. We need to merge after 18.2 is released </td> <td> https://gitlab.com/gitlab-org/gitlab/-/issues/554540 </td> <td>S/M</td> <td> :white_check_mark: </td> </tr> <tr> <td> **Consolidate 'vertex_ai_proxy' UP usage and ensure service mapping for relevant UPs** </td> <td> Same as above, but for Vertex We need to merge after 18.2 is released </td> <td> https://gitlab.com/gitlab-org/gitlab/-/issues/554541 </td> <td>S/M</td> <td> :white_check_mark: </td> </tr> <tr> <td> **Update GL and CDot with newest version of the library with UP \<-\> Service parity** </td> <td> We need to release new version of the libraries with updated up\<=\>service matching and make sure to update GL and CDot </td> <td> https://gitlab.com/gitlab-org/gitlab/-/issues/556133 </td> <td>S/M</td> <td> :white_check_mark: </td> </tr> <tr> <td> **Ensure generate_issue_description UP has 1:1 service mapping** </td> <td> Not related to vertex/anthropic proxy endpoints, but missing service with exact same name as UP We need to merge after 18.2 is released </td> <td> https://gitlab.com/gitlab-org/gitlab/-/issues/554542 </td> <td>S</td> <td> :white_check_mark: </td> </tr> <tr> <td> **Migrate and roll out CloudConnector::Tokens for all features** </td> <td> Once we have a clear path established for how to use the new Tokens factory, use FFs to cut over all remaining code paths. When this is done, we should be able to remove the `access_token` function. </td> <td> https://gitlab.com/groups/gitlab-org/-/epics/18873 </td> <td>M</td> <td> :white_check_mark: </td> </tr> </table>