Algolia

The Corma and Algolia integration brings Algolia team members under IT governance, next to the usage-based plan that pays for them, and makes API keys part of every offboarding. Algolia describes itself as the retrieval intelligence layer that turns intent into trusted, decision-grade outcomes; in practice, applications call its search API with API keys, some of them embedded in production frontend code. In Algolia, access is less about seats than about credentials: who is a team member on which application, and which keys can read or change your indices.

Key takeaways

• Algolia bills its Grow plan on search requests and records, not on seats, so Algolia governance is about access and API keys rather than seat counts.
• Each Algolia application has one owner, and the Admin API key held by that owner gives access to everything in the account.
• Removing an Algolia team member deletes the API keys Algolia created for that person, while keys the member created manually stay active.
• Algolia does not support SCIM provisioning, so team members are added and removed in the Algolia dashboard.

Why are API keys the identities to watch in Algolia?

Every Algolia API key carries an access control list (ACL) of allowed operations, such as search, addObject, deleteIndex or editSettings, plus optional restrictions on indices, rate limit and validity. The defaults are permissive: key validity defaults to 0, which means the key never expires, and the rate limit defaults to none. Algolia's own guidance is to regenerate all API keys at least once a year.

Keys are also tied to people. Removing a team member deletes the keys associated with that user, which breaks any integration that still depends on them, while keys the member created by hand keep working. That is why Algolia recommends running production on the application owner's keys. For IT, each key is a non-human identity with an owner, a scope and a lifespan.

How Corma governs Algolia

• Team members in reviews: Corma shows who has access to Algolia, including people with Team or API key permissions, and puts that access into automated access reviews for ISO 27001 and SOC 2.
• Offboarding with a key check: when a developer leaves, the IT workflow builder can add an approval step so the application owner confirms production no longer uses that person's keys before access is removed. Keys that Algolia creates for a team member carry that person's email address in their description, which makes them easy to trace.
• Usage-based spend: the Algolia plan, its monthly cost and its renewal sit with your other tools in SaaS subscription management.

Frequently asked questions

Does Algolia support SSO and SCIM?

Algolia offers SAML single sign-on for dashboard access on eligible committed plans, and its pricing page lists SSO on the Elevate plan. SCIM provisioning is not supported, so you cannot manage Algolia access from your identity provider. Read how SCIM and SAML differ.

How does Corma connect to Algolia?

Through an API integration where Algolia allows it, or through Corma's browser-based agents. Algolia team management is only available in its dashboard, so the agents work there in an isolated browser session, with credentials taken from your password vault, and every run is logged.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want to know who holds the keys to your search indices? Book a Corma demo.