## Start With the Workflow

Open [Integrations](/integrations) after choosing the Kit workflow and naming the data or action that must cross its boundary. Some connections are optional enhancements; others, such as Outreach email delivery, are required before the workflow can run end to end. The dashboard groups connections by purpose and shows only the cards relevant to your account, enabled products, and access level.

| Need | Available connection types | Read next |
|---|---|---|
| Team communication | Slack, inbound email, SMS, Twilio calling | [Slack Permission Levels](/docs/slack-permission-levels) |
| Scheduling | Google Calendar and Meet, calendar feeds, Calendly | [Calendar Integration](/docs/calendar-integration) |
| AI inside Kit | Google AI, Anthropic, OpenRouter, knowledge base | [AI Providers and Spend Controls](/docs/ai-providers-and-spend-controls) |
| External AI clients | Kit MCP and account-scoped remote MCP servers | [Connecting AI Assistants](/docs/connecting-ai-assistants) |
| Hiring delivery | GitHub assignment repositories and job-board connections | [GitHub Template Repository Setup](/docs/github-template-repository-setup) |
| Security operations | PagerDuty, Vanta, issue trackers, code-aware triage | [PagerDuty Integration](/docs/pagerduty-integration) |
| Identity and domains | Verified domains, SSO, directory provisioning, custom domains | [Single Sign-On and Provisioning](/docs/single-sign-on-and-provisioning) |
| Developer automation | API tokens, webhooks, MCP, custom domains | [API Reference](/docs/api-reference) and [Webhooks Overview](/docs/webhooks-overview) |
| Video | Mux for supported Hiring and Training video flows | Configure Mux from its Integrations card |

## Who Should Connect It

Connections that affect the whole account generally require an account admin. Personal connections, such as a member's calendar or MCP client, are owned by that member and remain limited by their live Kit permissions. Product-specific connections can also require the matching module or module-admin level.

Do not share one person's provider login or API token to avoid granting the right role. Invite the operator, grant the smallest useful access, and let them connect through the intended screen.

## Safe Setup

1. **Name the owner.** Decide who can rotate credentials, respond to failures, and remove the connection.
2. **Use the narrowest account or scope.** For example, select only calendars used for interviews and only repositories intended as assignment templates.
3. **Complete the live verification.** A saved credential is not necessarily a working connection.
4. **Run an internal test.** Send to an internal address, receive one test webhook, create a test meeting, or use a sandbox resource where the provider supports it.
5. **Check the receiving side.** Confirm sender identity, permissions, time zone, payload shape, and failure handling outside Kit.
6. **Record the recovery path.** Know how the team will detect expiry, revocation, delivery failure, or provider downtime.

## AI, Tokens, and Webhooks

- AI provider keys are account-wide secrets. They control where in-app AI requests are sent and which provider account is charged.
- MCP access is personal. The connection receives only the scopes the member grants and Kit rechecks that member's current access on each call.
- API tokens and webhook secrets are credentials. Store them in a secret manager, give them a clear owner, and rotate or revoke them when the consumer changes.
- Webhook delivery is asynchronous and can be retried. Consumers must verify signatures and handle duplicate events safely.

## Removing a Connection

Before disconnecting, identify the workflows using it. Removal can stop new sends, imports, meetings, uploads, or automated actions; it does not retract data already delivered to another system. After removal, verify the dependent Kit screen and rotate the provider credential if it may have been exposed.

## Quick Checklist

- [ ] The Kit-side workflow and the connection's exact responsibility are understood
- [ ] The owner and required Kit role are clear
- [ ] Provider permissions are no broader than necessary
- [ ] A live internal test passed end to end
- [ ] Failure and credential-rotation responsibilities are assigned
- [ ] Disconnect consequences are understood