> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-mcp-bridge-private-server.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a Kinde connector

> C1 provides identity governance for Kinde. Integrate your Kinde tenant with C1 for unified visibility and governance over users and organization membership.

C1 provides identity governance for Kinde. Integrate your Kinde tenant with
C1 for unified visibility and governance over users and their membership
in organizations.

## Capabilities

| Resource      | Sync                                                          | Provision |
| ------------- | ------------------------------------------------------------- | --------- |
| Users         | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Organizations | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |

The connector reads users and organizations from the Kinde Management API.
Each organization exposes a `member` entitlement; the connector syncs which
users belong to each organization.

This connector is read-only. It does not provision or modify access in
Kinde. Roles, permissions, and feature flags are not synced.

## Gather Kinde credentials

<Warning>
  Create a Kinde machine-to-machine (M2M) application authorized against the
  Kinde Management API with **`read:users`**, **`read:organizations`**, and
  **`read:organization_users`** scopes. All three are required.
</Warning>

<Steps>
  <Step>
    Sign in to the [Kinde dashboard](https://app.kinde.com/) for your tenant.
    Note your tenant subdomain — for example, if your dashboard is at
    `acme.kinde.com`, your API base URL is `https://acme.kinde.com`.
  </Step>

  <Step>
    Navigate to **Settings** > **Applications** and add a new application.
    Choose **Machine to machine (M2M) application** as the type, then save
    and copy the **Client ID** and **Client secret**.
  </Step>

  <Step>
    Open **Settings** > **APIs** > **Kinde Management API** > **Applications**.
    Add the M2M application you created.
  </Step>

  <Step>
    Under that application's scopes, enable **`read:users`**,
    **`read:organizations`**, and **`read:organization_users`**.
  </Step>
</Steps>

## Configure the Kinde connector

<Tabs>
  <Tab title="Cloud-hosted">
    Follow these instructions to use a built-in, no-code connector hosted by C1.

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Kinde** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Kinde connector.
      </Step>

      <Step>
        Set the owner for this connector.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter the Kinde credentials:

        * **Kinde base URL**: Your tenant API base URL, for example `https://acme.kinde.com` (no trailing slash, no `/api/v1` suffix).
        * **M2M client ID**: The client ID from your M2M application.
        * **M2M client secret**: The client secret paired with the M2M client ID.
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Kinde connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    Follow these instructions to run the Kinde connector in your own
    environment.

    <Steps>
      <Step>
        Create secrets for the Kinde M2M credentials.
      </Step>

      <Step>
        Configure the connector environment variables:

        ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}}
        BATON_BASE_URL=https://acme.kinde.com
        BATON_KINDE_CLIENT_ID=<M2M client ID>
        BATON_KINDE_CLIENT_SECRET=<M2M client secret>
        ```
      </Step>

      <Step>
        Deploy the connector using your standard self-hosted connector process.
      </Step>
    </Steps>

    **Done.** Your Kinde connector is now pulling access data into C1.
  </Tab>
</Tabs>

## Connector configuration reference

| Setting           | Environment variable        | Required | Description                                                                                                                   |
| ----------------- | --------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------- |
| Kinde base URL    | `BATON_BASE_URL`            | Yes      | Full Backend API base URL for your Kinde tenant, for example `https://acme.kinde.com`. No trailing slash or `/api/v1` suffix. |
| M2M client ID     | `BATON_KINDE_CLIENT_ID`     | Yes      | Client ID of the M2M application authorized against the Kinde Management API.                                                 |
| M2M client secret | `BATON_KINDE_CLIENT_SECRET` | Yes      | Client secret paired with the M2M client ID. Stored as a secret.                                                              |