Set up an Ory connector

C1 provides identity governance for Ory. Integrate your Ory project with C1 for unified visibility over user identities.

C1 provides identity governance for Ory. Integrate your Ory project with C1 for unified visibility over user identities synced from the Ory Admin API.

Capabilities

Resource	Sync	Provision
Users

The connector reads identities from a single Ory project’s Admin API and exposes them as users for cross-connector identity correlation. Ory organizations and Ory Permissions (Keto) roles are not synced — there are no groups, entitlements, or grants.

This connector is read-only. It does not provision or modify identities in Ory.

Gather Ory credentials

Use a project API key from the Ory Console, not a workspace key. Workspace keys are not authorized for the project’s /admin/identities endpoint.

1. Open the Ory Console and select the project you want ConductorOne to read.

2. Go to the project’s API Keys page and create a new project API key.

3. Copy the API key and store it securely.

4. Note the project’s Admin API base URL. For Ory Network this is https://{project_slug}.projects.oryapis.com/ (include the trailing slash). Self-hosted Ory Kratos deployments use their own admin host.

Configure the Ory connector

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for Ory and click Add.

3. Choose how to set up the new Ory connector.

4. Set the owner for this connector.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Enter the Ory credentials:

   • Base URL: The project’s Admin API base URL, including the trailing slash, for example https://acme.projects.oryapis.com/.
   • API token: The project API key you created in the Ory Console.
   • Project slug (optional): The Ory project slug for display only. This does not affect which host is contacted.
8. Click Save.

9. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Ory connector is now pulling identity data into C1.

Self-hosted

Follow these instructions to run the Ory connector in your own environment.

1. Create secrets for the Ory API token.

2. Configure the connector environment variables:

   BATON_BASE_URL=https://acme.projects.oryapis.com/
   BATON_API_TOKEN=<Ory project API key>
   BATON_PROJECT_SLUG=acme
   
3. Deploy the connector using your standard self-hosted connector process.

Done. Your Ory connector is now pulling identity data into C1.

Connector configuration reference

Setting	Environment variable	Required	Description
Base URL	BATON_BASE_URL	Yes	Ory project Admin API base URL, including the trailing slash. For Ory Network, https://{project_slug}.projects.oryapis.com/.
API token	BATON_API_TOKEN	Yes	Project-scoped Ory API key sent as Authorization: Bearer. Stored as a secret.
Project slug	BATON_PROJECT_SLUG	No	Ory project slug for display only. Does not affect API requests.