How to set up Attio API and integrations without leaking data

Native integrations: Workspace settings → Integrations. One-click installs for Slack, Gmail/Outlook, Calendar, Linear, Notion, Intercom, and a growing list. Always check here first.

Zapier / Make: for tools without a native integration, or for simple cross-tool plumbing (e.g. "new Stripe customer → create Attio Company"). Faster than custom code, slower at scale.

Direct API: for high-volume sync, custom logic, or anything Zapier/Make rate-limits become painful. Requires engineering effort but no per-task fees and full control.

Rule of thumb: native first, Zapier for under 1K events/day, custom API for over 1K events/day or any logic Zapier cannot express.

Document every integration in a single Integrations Inventory doc. Tool name, integration path, what it reads, what it writes, who owns it, last reviewed date.

Slack: Workspace settings → Integrations → Slack → Install. Authorize at the workspace level. Then each member subscribes individually to specific channels + events they want notifications for.

Gmail / Outlook + Calendar: covered in detail in the email + calendar sync tutorial. Connect per-user with privacy-first defaults.

Linear / Notion / Intercom: useful for product-led B2B SaaS teams. Each integration writes specific data into Attio (Linear issues become Attio activities, Intercom conversations attach to People records).

Install ONE at a time. Test each end-to-end before adding the next. Disconnect anything trial — every connected app is a permission grant and a data flow you will own.

Document each: what tool, what scope, what data flows, who installed it, why. This becomes the Integrations Inventory.

Zapier: connect via the Attio app on Zapier. Auth uses OAuth — log in via your Attio account, grant scope, done.

Common Zaps: "new Stripe customer → create Attio Company," "new Calendly meeting → create Attio Interaction," "new Typeform submission → create Attio Person."

Always include filter steps to avoid noise: 'Only continue if Stripe amount > $X,' 'Only continue if Typeform Page = pricing-form.'

Use idempotency: include a unique external ID in the Attio create action so re-runs do not create duplicates. Attio dedupes People by email and Companies by domain natively — use those as natural idempotency keys.

Make / Integromat: similar pattern with more powerful branching and array handling. Better for multi-step scenarios where Zapier feels limiting.

For high-volume Zaps (1K+ events/month), check the Zapier task pricing — it adds up fast. At that volume, custom API + webhooks is usually cheaper.

Workspace settings → API keys → Create new key. Name it for the use case ("Backend service — Stripe sync — prod") so revocation is targeted.

Set scopes: pick the minimum required. Read-only for analytics dashboards; Read + Write for data sync; Full access only when truly needed.

Store the token in an environment variable or secrets manager (AWS Secrets Manager, Doppler, 1Password Connect, Vercel env vars). NEVER commit to git.

Rotate tokens quarterly. Create a new token, deploy with new token, revoke old token, audit logs to confirm cutover.

For multi-environment setups (dev, staging, prod), use separate tokens per environment. Helps with audit and rate-limit isolation.

Common endpoints: GET /v2/objects (list objects), GET /v2/objects/{slug}/records (list records on an object), POST /v2/objects/{slug}/records (create record), PATCH /v2/objects/{slug}/records/{record_id} (update record).

For filtered queries: POST /v2/objects/{slug}/records/query with a JSON body specifying filters, sorts, limits.

Rate limits: as of 2026, default rate limit is ~100 requests/minute per workspace, with bursts allowed. Response headers include X-RateLimit-Remaining and X-RateLimit-Reset. Handle 429 responses with exponential backoff.

Pagination: use the cursor pattern. Response includes a `cursor` field; pass it as the `cursor` parameter in the next request. Loop until cursor is null.

Errors: 4xx for client errors (auth, validation), 5xx for server errors. Always log full error responses in dev; redact in prod logs.

Workspace settings → Webhooks → Create endpoint. Provide a URL (must be HTTPS), select event types (record.created, record.updated, list.entry_added, etc.).

Attio signs every webhook payload with HMAC SHA-256. Verify the signature in your handler (X-Attio-Signature header) — never trust an unsigned webhook.

Idempotency: every webhook includes a unique event ID. Store recently-processed event IDs and skip duplicates — Attio may retry on 5xx responses from your endpoint.

Handle slow responses: respond with 200 within 5 seconds, do heavy processing asynchronously (push to a queue). Webhooks that timeout get retried, multiplying load.

Common webhook patterns: 'on deal.stage = Closed Won, trigger our billing system,' 'on person.created, push to our data warehouse,' 'on list.entry_added, send a Slack DM.'

Open Integrations Inventory doc monthly. Confirm each entry: still in use? Still owned by the same person? Still scoped correctly?

Workspace settings → Integrations → review every connected app. Disconnect anything stale.

Workspace settings → API keys → review every token. Revoke unused ones. Confirm rotation schedule.

Workspace settings → Webhooks → review every endpoint. Confirm receiving URL still active (test with a manual trigger). Disable any returning 5xx consistently.

For security-sensitive workspaces (financial services, healthcare): consider a quarterly external audit. EverestX specialists offer this as a 1-2 day engagement.