Set up an Airtable connector

C1 provides identity governance and just-in-time provisioning for Airtable. Integrate your Airtable instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access to workspaces, bases, and groups.

Capabilities

The Airtable connector syncs the following resources:

Resource	Sync	Provision
Users
Groups
Workspaces
Bases
Invite Links

Permission levels:

• Workspaces: owner, create, edit, comment, read
• Bases: create, edit, comment, read (Airtable does not expose owner as a base-level permission)
• Groups: member
• Invite Links: Provisioning revokes (deletes) the link. Creating new invite links is not supported via the API.

Gather Airtable credentials

To configure the Airtable connector, you need Enterprise Admin permissions in Airtable.

1. Create a personal access token with enterprise admin scope:

   1. Log in to Airtable and navigate to airtable.com/create/tokens.

   2. Click Create new token.

   3. Name the token (for example, ConductorOne).

   4. Add the following scopes:

      Required for sync:

      • enterprise.account:read — lists enterprise workspaces
      • workspacesAndBases:read — reads workspace collaborators and invite links
      • schema.bases:read — reads base collaborators and invite links
      • enterprise.scim.usersAndGroups:manage — lists and provisions users and groups via SCIM

      Additional scopes required for provisioning:

      • workspacesAndBases:write — grants, revokes, and updates workspace and base collaborator access; deletes workspace and base invite links

   5. Click Create token and copy the value — it is shown only once.

2. Find your Enterprise Account ID:

   1. In the Airtable Enterprise Admin Panel, navigate to Settings.
   2. Your Enterprise Account ID appears in the URL or in the account details section. It begins with ent.

Configure the Airtable connector

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for Airtable and click Add.

3. Choose how to set up the new Airtable connector:

   • Add the connector to a currently unmanaged app
   • Add the connector to a managed app
   • Create a new managed app
4. Set the owner for this connector.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Enter the required configuration:

   • API Token: Your Airtable personal access token with enterprise admin scope.
   • Enterprise Account ID: Your Airtable enterprise account ID (starts with ent), found in the Enterprise Admin Panel.
8. Click Save.

9. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Airtable connector is now pulling access data into C1.

Self-hosted

Follow these instructions to use the Airtable connector, hosted and run in your own environment.

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals.

Resources

• Official download center: For stable binaries (Windows/Linux/macOS) and container images.

• GitHub repository: Access the source code, report issues, or contribute to the project.

Step 1: Set up a new Airtable connector

1. In C1, navigate to Integrations > Connectors > Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new Airtable connector:

   • Add the connector to a currently unmanaged app
   • Add the connector to a managed app
   • Create a new managed app
4. Set the owner for this connector.

5. Click Next.

6. In the Settings area of the page, click Edit.

7. Click Rotate to generate a new Client ID and Secret.

   Carefully copy and save these credentials.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Airtable connector deployment:

Secrets configuration

# baton-airtable-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-airtable-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # Airtable credentials
  BATON_AIRTABLE_TOKEN: <Airtable personal access token>
  BATON_AIRTABLE_ENTERPRISE_ACCOUNT_ID: <Airtable enterprise account ID>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-airtable.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-airtable
  labels:
    app: baton-airtable
spec:
  selector:
    matchLabels:
      app: baton-airtable
  template:
    metadata:
      labels:
        app: baton-airtable
        baton: "true"
        baton-app: airtable
    spec:
      containers:
      - name: baton-airtable
        image: public.ecr.aws/conductorone/baton-airtable:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-airtable
        envFrom:
        - secretRef:
            name: baton-airtable-secrets

Step 3: Deploy the connector

1. Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

2. Check that the connector data uploaded correctly. In C1, click Applications. On the Managed apps tab, locate and click the name of the application you added the Airtable connector to. Airtable data should be found on the Entitlements and Accounts tabs.

Done. Your Airtable connector is now pulling access data into C1.

---

All versions of this connector are available at dist.conductorone.com.