Skip to content
Merulan

Granola setup

What an operator supplies to connect the Granola Source, and the verification the provider requires.

Connecting Granola accepts a provider API key the operator pastes once. Merulan holds the credential directly. An operator who holds the material below connects in one pass.

Prerequisites

Granola refuses the connection until every item holds.

  • A Granola account that issues API keys.
  • A deployment reachable over HTTPS, because Granola refuses a webhook address that is not secure.

Credentials

Granola stores the credential under the direct custody the registry declares, so Merulan never shows the secret again once the connection is saved.

  • One Granola API key, pasted once and sealed on save.

Scopes

Granola requests the scopes the registry declares, and a grant missing one of them fails the first collection read.

  • personal
  • public
  • workspace

The Granola reach is chosen in the collection configuration rather than at a consent screen, and it may never widen beyond the principal the key belongs to.

Verification

Workspace-issued credential governs the Granola connection. Granola issues the key inside the customer account, so no application review stands between the key and production data.

  • Connect and map a Source runs the connect ceremony and binds collections once the credential is in hand.
  • Integrations lists every Source that carries a setup page, with its ceremony and verification posture.