Comment by bobfunk

It's the only option with the current OAuth model, however, we only use the token generated in your web browser, and talk directly to GitLab's API from there. We use the token to add a deploy key and a webhook to the specific repository we're linking to, and after that it's discarded. That way there's no long lived token stored on our end that has access to your whole account.