SaaS

Confluent

Connect your Confluent Cloud organization to Ploy to automatically discover user accounts, pending invitations, service accounts, and the roles each of them holds. This keeps your Confluent access picture up to date in Ploy, and lets Ploy invite new users to your organization when you ask it to.

Before you begin

  • You need access to the Confluent Cloud console as a user who can create service accounts and assign roles (an OrganizationAdmin can always do this).

  • Ploy connects using a dedicated service account that holds only the AccountAdmin role. AccountAdmin lets Ploy read your organization's users, service accounts, invitations and role assignments, and it also covers the one write Ploy can make: inviting a user to your organization (Confluent's invitations API). Ploy makes no other writes and has no access to your Kafka data, clusters, or billing.

  • The API key must use the Global key scope (the organization-wide scope for Confluent's management APIs). Keys scoped to a specific Kafka cluster, Schema Registry or Flink will not work.

Create a service account and API key in Confluent Cloud

  • Log in to the Confluent Cloud console.

  • Go to Accounts & access, open the Service accounts tab, and create a service account named something like ploy-integration.

  • Grant the service account the AccountAdmin role at the Organization scope. Do this from the organization's access settings, not the service account's own page: open the main admin menu, go to Accounts & access, open the Access tab, and click Add role assignment. Set the account to ploy-integration, choose AccountAdmin, and confirm the scope is Organization.

  • Tip: you're in the right place if AccountAdmin appears in the role list. If you only see Assigner and ResourceOwner, you're on the service account's resource page — back out to the org-level Access tab.

  • Open the menu in the top-right corner, click API keys, then click Add API key.

  • Under Select account, choose Service account and select the ploy-integration account you just created.

  • Under Select key scope, choose Global. Do not pick a specific Kafka cluster or other resource.

  • Give the key a name such as "Ploy", then create it.

  • Copy the Key (the key ID) and the Secret. Confluent shows the secret only once, so keep it to hand until you have finished the next section.

Connect Confluent to Ploy

  • In Ploy, click Integrations in the left sidebar.

  • Click Add new integration and search for Confluent.

  • In Confluent Cloud API Key ID, paste the key ID (for example ABCDE12345FGHIJ).

  • In Confluent Cloud API Key Secret, paste the secret.

  • Save the connection. Ploy verifies the credentials by looking up your Confluent organization, and the connection is labelled with your organization's name.

  • Newly assigned roles can take a minute or two to take effect in Confluent. If the connection does not verify immediately after you create the key, wait a moment and try again.

What data syncs

  • Users: every user in your Confluent Cloud organization, with name, email and login type.

  • Invitations: pending invitations, so access is visible from the moment someone is invited.

  • Service accounts: the non-human identities used by your applications and pipelines.

  • Role bindings: which Confluent roles each user and service account holds across the organization.

Data syncs periodically to keep Ploy up to date.

What Ploy can do in Confluent

  • Invite a user: when you ask Ploy to create a Confluent user (for example from an onboarding flow), Ploy sends an invitation to that email address through Confluent's invitations API. Confluent has no direct "create user" — membership starts as a pending invitation, and the new user appears in Ploy on the next sync. If the person is already a member of your organization, the invitation is skipped and the action is treated as complete.

  • This is the only write Ploy makes. It works under the AccountAdmin role described above, so no extra permissions are needed.

Troubleshooting

"Could not connect to Confluent with these credentials"

Check that the key uses the Global scope rather than a key for a specific Kafka cluster, and that the service account that owns the key has the AccountAdmin role at the Organization scope. If you have just assigned the role, wait a minute or two for it to take effect and try again.

Lost the secret

Confluent only displays an API key's secret once. If you no longer have it, create a new API key and connect again in Ploy.

Was this helpful?
Was this helpful?