Connect an existing provider

Customer teams connect provider admin credentials in the SuperPenguin dashboard so billed usage and cost can be synced for reconciliation and coverage checks.

Typical flow

1. Open Integrations / Connections in the dashboard.
2. Choose the provider (OpenAI, Anthropic, Deepgram, ElevenLabs, Cursor, cloud billing connectors, and others as listed in-product).
3. Follow the provider-specific credential steps in the connection wizard.
4. Wait for the initial backfill, then confirm recent billed rows appear.

Credentials are stored encrypted. SuperPenguin uses them only for read-oriented billing and usage syncs defined by that integration.

AWS Bedrock billing

You need an AWS administrator who can create an IAM policy, user group, and user in the account whose bill you want to read. SuperPenguin connects using an access key for a dedicated API-only IAM user.

1. In SuperPenguin, open Integrations, select Connect, then choose AWS Bedrock.
2. In the wizard's Create an IAM policy step, copy the policy JSON. Open IAM > Policies > Create policy in AWS, select JSON, paste the policy, and save it with a recognizable name such as SuperPenguinBillingReadOnly.
3. Open IAM > User groups > Create group. Name a dedicated group, such as superpenguin-billing, and attach the policy you just created to that group.
4. Open IAM > Users > Create user. Name a dedicated user, such as superpenguin-readonly. Leave Provide user access to the AWS Management Console unchecked. Choose Add user to group and select your new group.
5. Open the user's Security credentials tab. Under Access keys, choose Create access key, select Third-party service, and complete AWS's creation steps. Copy the Access key ID and Secret access key while the secret is visible.
6. Return to SuperPenguin, paste both values, select the AWS regions you use, and finish connecting. Wait for the initial history import, then open the AWS Bedrock provider page to check the billed costs.

Attach the billing policy to the group, rather than directly to the user. This and leaving console access disabled address the common group-permission and console-MFA checks at setup. Your organization's enabled compliance tests may have additional requirements. The policy still reads the same Cost Explorer billing data; no model-invocation permission is needed.

Assign an owner to the integration and record your required key-rotation date. To replace a key, disconnect and reconnect Bedrock in SuperPenguin using the new key, confirm the connection works, then remove the old AWS key.

Already connected? Your existing connection continues to work. To move an existing user's permissions into a group, attach its billing policy to a dedicated group and add the user to it. Verify billing sync works before removing the direct policy attachment. This change does not require a new access key or reconnecting SuperPenguin.

Azure billing

You need permission to register an application in your Microsoft Entra tenant and assign roles on the Azure subscription whose bill you want to read. An administrator may need to complete those steps for you.

1. In SuperPenguin, open Integrations, select Connect, then choose Azure.
2. In Azure, open Microsoft Entra ID > App registrations > New registration. Give the app a recognizable name, such as SuperPenguin Cost Reader, use the single-tenant option, and register it. A redirect URI is not required.
3. From the app's Overview, copy Directory (tenant) ID and Application (client) ID into the corresponding SuperPenguin fields.
4. Open Certificates & secrets > Client secrets > New client secret. Choose an expiry allowed by your organization's policy and record the renewal date. Immediately copy the secret's Value, not its Secret ID, into Client Secret Value in SuperPenguin. Azure shows the value only once.
5. Open Subscriptions, select your subscription, then Access control (IAM) > Add > Add role assignment. Select Reader, go to Members, select User, group, or service principal, and use Select members to find your app by name. Select the app and complete Review + assign.
6. Repeat the role assignment for Cost Management Reader, using the same app and subscription. Copy the Subscription ID into SuperPenguin.
7. Finish connecting. If a newly assigned permission has not propagated yet, allow a few minutes and retry. Wait for the initial history import, then open the Azure provider page to check the billed costs.

The wizard also offers a custom-role alternative. Use either its complete custom role or the two built-in roles above. Assign permissions to the app's service principal on the subscription you entered in SuperPenguin.

Before the client secret expires, create a replacement, disconnect and reconnect Azure in SuperPenguin using its new Value, verify the connection works, and remove the old secret.

Check the result

After either setup, the integration should appear as connected and its initial history import should finish. Use Fetch Latest to verify a repeat sync. An account with no AI charges in the selected period can correctly show zero cost. Billing Reconciliation compares provider bills with request attribution; connecting a billing account alone does not create SDK request data.

SDK vs connection

You usually want one request-attribution path (SDK or hosted OTLP) plus a provider connection for invoice truth. Broadcast sampling, credits, settlement, and BYOK mean request rows are not a guaranteed invoice feed.

Building a provider API instead?

If you are a provider implementing export endpoints for SuperPenguin (and other FinOps clients), go to Build a billing integration. That path is unrelated to pasting an admin API key into the dashboard.