Vendor Integrations & Client Connectivity

Kanawai AI connects securely to enterprise tools and cloud platforms using industry-standard authentication protocols. This document details the connectivity approach, security controls, and best practices for each supported integration.

Last updated: September 15, 2026

Integration Architecture Overview

Kanawai AI follows a zero-trust integration architecture where every connection is authenticated, encrypted, and scoped to the minimum permissions required. All vendor connections flow through a centralized integration layer that provides unified logging, rate limiting, and credential management.

Least Privilege

Every integration requests only the minimum API scopes and permissions required for its specific function. Permissions are audited quarterly and pruned when no longer needed.

Credential Lifecycle

All credentials, including API keys, OAuth tokens, and certificates, are stored in enterprise secrets managers with automated rotation, expiration enforcement, and audit logging.

Centralized Gateway

All vendor API traffic routes through a centralized integration gateway that enforces authentication, rate limiting, request validation, and comprehensive audit logging.

Vendor Integration Directory

Each vendor integration below details the specific connection method, authentication protocol, data scope, and security controls implemented by Kanawai AI. All integrations use the most secure authentication method available from each vendor.

Anthropic Claude

Cloud API / API Key with AI Gateway

API Key

Data scope: AI inference requests, prompt/response data (ephemeral)

API keys stored in enterprise secrets manager (e.g., GCP Secret Manager, HashiCorp Vault)

Routed through centralized AI Gateway for unified access control and audit logging

Separate API keys per environment (dev/staging/prod) with automated rotation every 30–90 days

Rate limits and spend caps configured per-key to prevent credential abuse

AWS

IAM Cross-Account Roles / STS AssumeRole

IAM Roles

Data scope: Cloud resources, infrastructure metadata, security configurations

Cross-account access via STS AssumeRole with temporary credentials (no long-lived access keys)

ExternalId required in trust policies to prevent confused deputy attacks

Trust policies scoped to specific IAM role ARNs, never wildcard root account access

All AssumeRole calls audited via AWS CloudTrail with centralized log aggregation

Cloudflare

Scoped API Tokens / Access Service Tokens

API Key

Data scope: DNS records, WAF configurations, Workers, analytics

Scoped API tokens restricted to specific zones, accounts, and permission sets, never global API keys

Access Service Tokens for machine-to-machine communication with zero-trust enforcement

JWT validation at the edge for API gateway authentication

New scannable token format (cfut_/cfat_) enables automated secret scanning and leak detection

Cursor

Admin API key

API Key

Data scope: Tokens + spend per member, team, and model.

Per-member usage tracking

Detects Teams and Enterprise admin surfaces directly from the key

Datadog

Read-only API keys

API Key

Data scope: AI egress by destination and service; tokens and models where instrumented.

Read-only access limits exposure

Content-adjacent retention is off so prompt/response text is never requested

Integrates with existing telemetry (network logs, APM spans, metrics, Agent Observability)

Discord

Bot Token / OAuth 2.0 with PKCE

Bot Token

Data scope: Channel messages, user presence, server metadata

Bot tokens stored in secrets manager, never hardcoded in source

OAuth 2.0 with PKCE for user-delegated authorization flows

Webhook signature verification using Ed25519 public key validation

Short-lived access tokens (15–30 min) with refresh token rotation

Forescout

API Token

API Key

Data scope: Endpoint telemetry, network access logs, shadow IT detection.

Real-time contextual information about devices and users on the network

Detects unauthorized AI tools via network traffic

Bidirectional data exchange with Forescout for advanced network access control and remediation.

Google Cloud (Vertex AI)

Service-account (or WIF)

Service Account

Data scope: Model tokens + billing (project grain).

Model token metrics and billing export

Workload Identity Federation (WIF) avoids long-lived service account keys

All API traffic remains within GCP private network when possible

GCP Organization Policies prevent unauthorized service account key creation

Google Workspace

OAuth 2.0 / Domain-Wide Delegation

OAuth 2.0

Data scope: Email metadata, calendar events, Drive files, Admin directory

Domain-Wide Delegation with granular OAuth scope restriction, limited to only the minimum required scopes

Service account keys stored in GCP Secret Manager with automated rotation

All DWD actions audited via Google Workspace Audit Logs exported to SIEM

GCP Organization Policies restrict who can create or upload service account keys

HubSpot

OAuth 2.0 (v3) / Private App Token

OAuth 2.0

Data scope: CRM contacts, deals, marketing events, engagement data

OAuth v3 endpoints for multi-account integrations with enhanced security features

Private App tokens for single-account use with mandatory 180-day rotation

Webhook signature validation (X-HubSpot-Signature-v3) with HMAC SHA-256

Scopes audited regularly, legacy API keys deprecated and not used

Microsoft 365 (Graph API)

Microsoft Graph API / OAuth 2.0 Client Credentials

OAuth 2.0

Data scope: Email, calendar, Teams, OneDrive, user directory

Certificate-based client credentials flow, avoiding client secrets where possible

Application permissions scoped to specific Graph API resources (e.g., Mail.Read, not Mail.ReadWrite.All)

Conditional Access policies enforced for service principal sign-ins

Sign-in logs monitored via Microsoft Entra for anomaly detection

Microsoft Azure

Entra ID App Registration / Service Principal

OAuth 2.0

Data scope: Azure resources, Entra ID directory data, security configurations

Certificate-based authentication preferred over client secrets for service principals

Credentials stored in Azure Key Vault with Managed Identity access

Application permissions scoped to specific resources, no tenant-wide admin roles

Unique app registrations per environment with automated credential rotation

Microsoft Copilot

Microsoft Graph API / OAuth 2.0

OAuth 2.0

Data scope: Copilot interactions, productivity data, AI usage analytics

OAuth 2.0 Client Credentials flow with certificate-based authentication

Application permissions scoped to least-privilege Graph API endpoints

Delegated permissions used only when user context is required

Token caching with automatic refresh, no persistent credential storage

OpenAI (Enterprise)

Admin API key

API Key

Data scope: Tokens + cost per model/project.

Per-model/project token and cost consumption metering for organizational visibility without routing traffic through a proxy

API keys centrally managed via enterprise secrets manager with automated rotation

Spend limits configured in OpenAI dashboard

Pre-commit hooks scan for accidentally committed API keys in source repositories

OpenRouter

API Key

Data scope: Unified AI model usage, tokens, and cost tracking across hundreds of models.

Single endpoint for multiple models simplifies credential management

Spend caps and usage monitoring centralized

Ability to dynamically route LLM prompts to specified models and providers based on cost or security policies.

Rippling

OAuth 2.0 / HTTP Bearer Auth

OAuth 2.0

Data scope: Workforce identity, user directories, app user provisioning.

Identity provider sync for attributing AI token consumption to specific users, roles, and departments

Token-based authentication

Salesforce

OAuth 2.0 JWT Bearer / External Client App

OAuth 2.0

Data scope: CRM data, opportunities, accounts, custom objects

JWT Bearer flow with RSA key pair, no client secrets transmitted; private key stored in KMS/HSM

External Client Apps preferred over legacy Connected Apps for API-first security model

Dedicated Integration User with minimum required permission sets, never admin accounts

IP allowlisting enforced to restrict API access to known Kanawai AI infrastructure IPs

Slack

OAuth 2.0 / Bot Token (xoxb-)

OAuth 2.0

Data scope: Channel messages, user profiles, workspace metadata

Bot token scopes (xoxb-) preferred over user token scopes for isolated, app-level access

Granular OAuth scopes, limited to minimum permissions requested and justified per feature

Slack App Approval workflow integration for enterprise workspace governance

Audit Logs API integration for SIEM monitoring of all app activity

SpaceXAI (Grok Enterprise)

API Key

Data scope: AI inference requests, model token consumption, costs.

API keys managed via enterprise secrets manager

Routes through AI Gateway for unified logging and rate limiting

Vercel AI Gateway

AI Gateway API key

API Key

Data scope: Tokens + charged USD per model/day, Vercel-priced.

Per-model token and charged-cost metering across every model routed through the gateway

Centralized billing visibility

Client Tenant Connectivity

Kanawai AI provides flexible, secure connectivity options for connecting to client-managed infrastructure, identity providers, and cloud tenants. Customers are responsible for provisioning and maintaining their API credentials through the Kanawai AI self-service portal.

Customer-Provided Authentication

Kanawai AI assumes that the client will provide authorized, authenticated credentials through one or more of the following mechanisms:

API credentials and secure tokens: OAuth 2.0 client credentials, API keys, or service account keys provisioned by the customer with scoped permissions.
Webhooks: customer-configured webhook endpoints with shared secret or HMAC signature verification for event-driven data exchange.
Identity Platform-as-a-Service: integration with enterprise identity platforms including Okta, MuleSoft, Apigee, and Google Cloud Application Integration for federated authentication and API management.

Self-Service Onboarding Portal

Customers can onboard new integrations, configure credentials, and manage API keys through the Kanawai AI self-service portal, with no support tickets or manual provisioning required.
The portal provides guided setup workflows for each integration, including scope selection, credential validation, and connectivity testing.
All credential changes are logged with full audit trails, including who made the change, when, and from which IP address.

Customer Responsibility

The customer is solely responsible for maintaining and administrating API keys, secrets, certificates, and other authentication mechanisms used to connect Kanawai AI to their infrastructure. This includes:

Provisioning credentials with least-privilege permissions
Rotating credentials according to their organization's security policies
Revoking credentials immediately when they are no longer needed or may be compromised
Ensuring that all credentials are created within authorized, auditable systems