Aikido Security

Connect Aikido Security to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Aikido Security:

   1. As an Aikido workspace admin, open the REST API integrations page in Aikido (https://app.aikido.dev/settings/integrations/api/aikido/rest).
   2. Create client credentials there. This produces a client ID and a client secret.
   3. Grant the scopes issues:read (read access to issue resources) and repositories:read (read access to code repositories).
   4. Copy the client ID and client secret into Safeguard. Safeguard exchanges them for an access token with the OAuth 2.0 Client Credentials grant at https://app.aikido.dev/api/oauth/token.

   Where to find the other values:

   • Client ID: Shown on the Aikido REST API integrations page after you create client credentials.
   • Region: The Aikido region your workspace is hosted in. Aikido's API reference lists Europe (app.aikido.dev), the United States (app.us.aikido.dev), Australia (app.au.aikido.dev) and the Middle East (app.me.aikido.dev).
   • Access token (optional): Not needed when the client ID and secret are supplied; an access token comes from a POST to https://app.aikido.dev/api/oauth/token with grant_type client_credentials.

   Aikido Security's public documentation does not cover every step.

   Aikido's docs name the integrations page and say a workspace admin must create the client credentials, but do not quote the button labels or the scope picker UI, so the clicks inside that page are not sourced. The scope names come from Aikido's API reference. The docs do not give the access token lifetime or say whether the client secret is shown only once.

   Source: apidocs.aikido.dev, apidocs.aikido.dev, apidocs.aikido.dev, checked 2026-10-07.

   The permissions Safeguard needs: issues:read, repositories:read.

2. On Compliance › Connectors, open Aikido Security, click Connect, choose API token and fill in:

   Field	What to enter
   Client ID	Optional.
   Client secret	Optional. Stored encrypted and never shown again.
   Region	Required.

   Or, instead: Access token (optional).

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Aikido Security and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Vulnerability Scanning connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks