Customer setup guide

Connect one Neon organization.

Create a customer-owned organization API key, submit it in the Sythe Labs platform, and let the platform inventory projects and configuration without changing Neon. Neon does not issue read-only API keys. The platform performs only the documented GET operations.

Open signed-in Integrations Read Neon API key documentation

Connection availability

The signed-in Sythe Labs platform Integrations page is the source of truth for connection access. This public page documents customer setup and does not announce availability.

Overview

A GET-only path for Neon project posture.

The Sythe Labs platform reads one Neon organization and the projects visible to the customer-owned API key. It maintains inventory and evaluates four supporting configuration checks. It does not issue requests that create, mutate, or delete anything in Neon, and it does not collect an organization member roster.

Read pathGET requests only

Classify the key

Confirm the API key is usable and record whether it is an organization or personal key.

GET /auth

List memberships

Resolve the single Neon organization this connection may bind to.

GET /users/me/organizations

Read the organization

Collect the organization name used to bind the connection.

GET /organizations/{org_id}

List projects

Collect every current project in that organization, following pagination until the list is complete.

GET /projects

List branches

Resolve the default branch for each project so backup schedule can be read.

GET /projects/{project_id}/branches

Read backup schedule

Observe the default-branch backup schedule used by the snapshot check.

GET /projects/{project_id}/branches/{default_branch_id}/backup_schedule

Before you start

Choose the organization and keep the key customer-owned.

The customer creates and controls the credential. Do not send a Neon API key to Sythe Labs staff, paste it into a support request, or ask staff to enter the Neon console.

01
A Neon organization administrator for the organization you intend to connect.
02
One Neon organization selected for this connection.
03
Organization administrator access to the signed-in Sythe Labs platform Integrations page.

Create the API key

Prefer an organization key. Never choose Project-scoped.

Neon has no token permission groups and does not issue read-only API keys. An organization key has admin-level management access to every project in the org. A personal key has the creating user's access. Sythe Labs only performs the GET requests listed in this guide.

Neon does not issue read-only API keys

An organization key has admin-level management access to every project in the org. A personal key has the creating user's access. Sythe Labs only performs GET requests listed below and never creates, mutates, or deletes Neon resources. Do not look for Viewer or Editor checkboxes on API keys. They do not exist.

Request this	Where	Why
Organization API key	Neon org Settings → API keys → Create new. Do not choose Project-scoped.	Lists every current and future project in that org.
Personal API key	Account settings → API keys	Accepted only if the user belongs to exactly one Neon org.

01
Open the intended organization in the Neon console.
02
Go to Settings, then API keys, and choose Create new.
03
Create an organization API key. Do not choose Project-scoped.
04
Give the key a name that identifies its use by the Sythe Labs platform.
05
Copy the generated secret directly into your password manager. Neon shows it only once.

Open Neon console

Connect in the Sythe Labs platform

Enter the customer-owned API key.

01
Open the signed-in Sythe Labs platform Integrations page and open the Neon connection form when it is shown.
02
Enter the customer-owned Neon API key. The form does not ask for an organization ID or project ID.
03
Select Connect. This classifies the key and confirms it resolves to exactly one Neon organization.
04
Connect preflight classifies the key and lists projects. The first sync reads branches and backup_schedule. Neon does not issue read-only API keys.

Connection stays unchanged after failed validation

A denied, incomplete, canceled, or unsupported result does not store a new key, remove inventory, or mark the sync successful. Correct the reported reason and submit again.

Access and data

Inventory projects without collecting a member roster.

Organization

The connected Neon organization is the account boundary for this connection.

Projects

Every current project visible to the key in that organization, including future projects an organization key can list.

Configuration

IP allowlists, public-connection blocking, history retention, and the default-branch backup schedule for each project.

Excluded

Organization members, branches other than the default used for backup schedule, endpoints, databases, roles, consumption, functions, buckets, and SQL contents.

Supporting configuration checks

NEON-NET-01: every project has a nonempty IP allowlist
NEON-NET-02: every project blocks public connections
NEON-REC-01: every project retains history for at least 7 days
NEON-SNAP-01: every project has a default-branch backup schedule

Only a complete successful sync refreshes inventory and supporting evidence. An empty project list is a valid success. The connector does not collect organization members.

Key lifecycle

The customer controls rotation and revocation.

The Sythe Labs platform stores the key as an opaque encrypted secret and uses it only for the bounded GET operations in this guide. Neon remains the source of truth for key status and revocation.

Replace

Create a new organization API key in the same Neon organization and replace it in the Sythe Labs platform. Replacement preflight classifies the key and lists projects; the first sync after replace reads branches and backup_schedule. Do not replace with a project-scoped key or a personal key that belongs to more than one organization.

Expire

Replace a key before you revoke it in Neon. The Sythe Labs platform does not extend, rotate, or renew customer keys.

Revoke

Revoke the old key in the Neon console after a replacement succeeds, or revoke the current key when access must stop immediately. The Sythe Labs platform never revokes a Neon API key.

Disconnect

Disconnect in the Sythe Labs platform to stop scheduled syncs and remove Neon-discovered inventory from active inventory. Revoke the key in Neon separately. Manually managed inventory remains in place.

Clean up

After disconnecting, confirm the key is revoked in Neon and remove customer-held copies under your credential-retention process. The Sythe Labs platform deletes its encrypted copy during disconnect.

Troubleshooting

Resolve a reported stable reason.

A failed connection or key replacement can report a stable reason, guide link, or request identifier. Match any reported reason to the action below. An asynchronous sync status retains only its safe failure message. Never copy the Neon API key into a message.

This authentication method is not supported

neon_unsupported_auth_method

Create a new organization API key in Neon org Settings → API keys. Do not use OAuth, Neon Auth, MCP, or any credential that is not a Neon API key.

Project-scoped keys are not supported

neon_project_scoped_key

Create a replacement organization API key. In Neon org Settings → API keys, choose Create new and do not choose Project-scoped. Then replace the key in the Sythe Labs platform.

This personal key does not belong to an organization

neon_personal_key_no_org

Create an organization API key in the Neon organization you intend to connect, or use a personal key for a user who belongs to exactly one Neon organization.

This personal key belongs to more than one organization

neon_personal_key_ambiguous_org

Create an organization API key in the one Neon organization you intend to connect. A personal key is accepted only when that user belongs to exactly one Neon organization.

The replacement key belongs to a different organization

neon_org_mismatch

Create a replacement key in the same Neon organization that is already connected. Disconnect first only when you intend to bind a different organization.

The API key is not usable

neon_invalid_key

Create a new organization API key in Neon, copy it directly into your password manager, and replace it from the signed-in Integrations page. Neon shows the generated secret only once.

Neon is temporarily unavailable

neon_upstream_unavailable

Retry from the Sythe Labs platform after Neon service recovers. The existing connection and inventory remain unchanged after an incomplete sync.

Neon returned an unsupported result

neon_unexpected_response

Neon returned a response the Sythe Labs platform could not safely interpret. This does not by itself mean the key is invalid.

1Retry once from the signed-in Integrations page with the same API key.
2Wait for a pending Sythe Labs platform update before trying again. Do not broaden the key or switch to a project-scoped key to resolve an unsupported response.
3If it repeats, send the stable reason and platform request ID to Sythe Labs support. Do not include the API key.

Need platform help?

Use the Sythe Labs support page and include the stable reason code and any safe request identifier shown in the Sythe Labs platform. For an asynchronous sync status, include only the safe failure message shown there. Do not include the API key.