Skip to content

Connecting your first source

A cost source (AWS, GCP, Anthropic, Snowflake, etc.) is a provider Plutus pulls spend data from on a schedule. Connecting one is the same flow regardless of provider — only the credential form changes.

Go to Settings → Connections. This lists every cost source Plutus supports, grouped by category, with a status badge for any you’ve already connected.

Click the source you want to connect. Each source uses one of three credential methods:

  • API key — you paste a key generated in the provider’s own console (Anthropic, OpenAI, Datadog, and most others).
  • OAuth — you click Connect and authorize Plutus on the provider’s own login screen (Salesforce is currently the only cost/event source using this).
  • IAM role — you paste a role ARN that Plutus assumes to read billing data, with no long-lived secret stored (AWS, GCP, Azure).

The exact fields and where to find them are documented on that source’s own page under Sources & integrations — open it if you’re not sure what a field expects or need provider-side setup steps (e.g. creating a scoped API key or a cross-account role).

Enter the required fields and click Save. Plutus encrypts the credentials at rest and never displays them back to you — a saved field shows as filled but not as its value, so editing a connection later only requires entering fields you’re changing.

Saving a connection triggers an initial sync automatically. A first sync can take a few minutes, longer for sources with a large historical window, since it’s pulling as much history as your plan’s retention covers rather than a single day. The connection’s status badge on the Connections page reflects sync progress and flips to an error state with a message if something goes wrong (an invalid key, a missing permission, etc.) — same badge you’d check for any source, not just the first one.

Once the first sync finishes, cost data appears in Cost Explorer and on the dashboard.

After the first sync, Plutus keeps the connection up to date on a recurring interval — not real-time. Every 15 minutes, a background scheduler checks which connections are due and enqueues a new sync for each one; most sources default to syncing once or a few times a day, depending on the source. You can trigger an out-of-cycle sync yourself from the Connections page (“Sync now”), which is rate-limited to avoid hammering the provider’s API — you can’t fire it more than once every few minutes on the same connection.