This guide walks you through connecting a Replit Enterprise Account to Clarion. Once connected, Clarion’s Exposure Agent sweeps the Account daily: it lists your workspaces and deployments, reads each deployment’s privacy setting, checks whether the public ones actually answer on the internet, and opens an issue for anything that looks internal but is reachable by anyone.
Estimated time: 5 minutes. You will need to be an admin of a Replit Enterprise Account, since the Admin API is only available to Account admins on Enterprise Accounts.
Prerequisites
- A Replit Enterprise Account, and admin access to it
- The ability to create an Admin API key with read scope
- A Clarion workspace with the Replit integration page open
One Clarion workspace connects one Replit Account. The key you paste grants read access to everything in the Account that issued it, so create it from the Account whose deployments you want swept.
Step 1 — Create an Admin API key in Replit
- Sign in to Replit as an Account admin.
- Open your Account settings and find the Admin API section.
- Create a new API key with read scope.
- Copy the key. It begins with
rpl_.
Copy the key immediately and store it securely — Replit may only show it once. Grant read scope only; Clarion never writes to Replit.
Step 2 — Enter the key in Clarion
- In Clarion, open Integrations and find Replit under Development & Planning.
- Paste your Admin API key.
- Click Connect.
Clarion checks the key against Replit before saving it. If the key is wrong or the Account is not entitled to the Admin API, you’ll see a clear error and nothing is stored. To rotate a key later, paste the new one and connect again — it replaces the old one.
What the exposure agent does
The Exposure Agent runs a daily sweep of every provider you have connected. For Replit it:
Deployments set to password or private are recorded as gated and never contacted.
The reachability check is read-only: Clarion requests the deployment’s root address, follows at most two redirects, and keeps only the status code, byte count, and whether the page mentioned signing in. No page content, headers, or cookies are stored, shown, or sent to the agent.
/replit action, which exposes these read-only tools:
All six are read-only and need no approval. None of them can change anything in Replit.
Disconnect
To remove the integration:
- In Clarion, open Integrations → Replit.
- Click Disconnect.
This deletes the stored key. The exposure agent stops sweeping Replit, and any saved skills that reference the /replit action will surface the integration as missing until you reconnect.
Troubleshooting
”Replit rejected the key”
The key is malformed, unknown, revoked, or expired. Create a fresh Admin API key in your Replit Account settings and connect again. Check that you copied the whole key, including the rpl_ prefix.
”The key needs read scope and Enterprise Admin API entitlement”
Replit authenticated the key but refused the request. Either the key was issued without read scope, or the Account is not an Enterprise Account with Admin API access. Confirm both with your Replit administrator.
A deployment I expected is missing from the sweep summary
If the summary says coverage was incomplete, Replit returned more results than a single sweep walks, and some deployments were not examined. Each run starts from the beginning rather than resuming where the last one stopped, so the same deployments are examined every time and the ones past the limit stay unexamined until the limit is raised. The summary reports this per run, so incomplete coverage is always stated rather than implied. If you see it, let us know how many workspaces and deployments your Account has. 
