An explanation on user_save() works
The first snippet doesn't work because Drupal doesn't use any 'gitlab_refresh_token' array index, and it doesn't know any field with that name. If you were trying to change the value of a field added with the field UI, the array needs to have a different structure, to be saved.

The second snippet works because Drupal effectively uses that array index, as also said in the documentation.


  Key / value pairs added to the $edit['data'] will be serialized and saved in the {users.data} column.


// Prepopulate $edit['data'] with the current value of $account-&gt;data.
// Modules can add to or remove from this array in hook_user_presave().
if (!empty($account-&gt;data)) {
  $edit['data'] = !empty($edit['data']) ? array_merge($account-&gt;data, $edit['data']) : $account-&gt;data;
}