Setup Magit Forge to connect Gitlab

Question

I am using a Gitlab, say gitlab.company.org. My username on that machine is user and I am using 2FA.

I have read the Forge User and Developer Manual. It asked to read and follow the instructions of the GHub User and Developer Manual, which I did.

I also read How to set up Magit Forge with Gitlab?, but there is still no real solution/accepted answer, so it was not of much help to me.

The Ghub Manual states, that I have, first of all, to set up a global user name, which I did.

Next, I had to go to the Gitlab web site and create a personal token. So I did, created a token, choose write_repository first, but added a second token later with api scope.

Next I copied the generated token(s) into my already existing ~/.authinfo file, as was suggested in the Ghub Manual. The entry meanwhile reads

machine gitlab.company.org/api/v4 login user^ghub password abcdef1234...

Now it was time to go back to the Forge Manual, Chapter 3 "Gettings Started" and to read its subsections. Subsection 3.1 "Token Creation" hinted, that, for Gitlab, I need the api scope, so I dropped the initial token, created a new one, ...

I also copied the URL https://gitlab.company.org/api/v4 into my web browser and it worked (kind of), by returning this string {"error":"404 Not Found"}. As the Gitlab Docs offered some more URLs, I next tried https://gitlab.company.org/api/v4/version, which resulted in {"version":"14.6.1","revision":"661d663ab2b"}. This convinces me, that the server is working correct and Emacsen should be able to get results.

BTW: The access tokens page shows, that the correct token was used to contact the server (last_used 2 minutes ago). I feel I am on the right way.

On that stage I stoped, changed again into emacs and typed the following into the *scratch* buffer

(setq auth-sources '("~/.authinfo"))

and run eval-last-sexp. No errors.

Next I inserted something similar like this

(ghub-request "GET" "/user" nil
              :forge 'gitlab
              :host "gitlab.company.org/api/v4"
              :username "user"
              :auth 'ghub)

and evaled it also. This gave some noticeable errors, but showed, that emacs was reading from ~/.authinfo file. After some fiddling on that expression as well as the content on ~/.authinfo, I got the contents listed above. When I evaled that sexp, I get a result, but not in the desired form:

if: HTTP Error: 403, "Forbidden", "/api/v4/user", ((error . "insufficient_scope") (error_description . "The request requires higher privileges than provided by the access token.") (scope . "read_user api read_api")) Interesting enough, the last_used counter doesn't change.

Thats how far I came. But now I have no idea, what to try next. AFAIK the api scope is the most powerful scope with no limitations.

Any hints, what to change?