Connect SpamTitan to Conduit

This walkthrough connects SpamTitan (email security gateway) to Conduit. SpamTitan comes in two flavors and the form covers both: if TitanHQ hosts your SpamTitan, you only need an API key; if you self-host the gateway (common for MSPs), you also enter your own gateway’s Base URL.

Menu labels can change

The SpamTitan steps below reflect the admin-console flow at time of writing; menu labels can shift between releases. If a label differs, follow TitanHQ’s guide to using APIs in SpamTitan Gateway.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A SpamTitan admin-console login that can generate an API key.
• To know whether your SpamTitan is TitanHQ-hosted or self-hosted. If you sign in at your own domain (for example https://your-spamtitan.example.com), it’s self-hosted and you’ll need that URL in Step 2.

Step 1 — Create an API key in SpamTitan

1. Sign in to your SpamTitan admin console. Expected: the SpamTitan dashboard.
2. Generate an API key in the admin console, following TitanHQ’s API guide. Expected: a key value you can copy.
3. Copy the key.

Caution

Copy the key now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the key, regenerate it in SpamTitan first; the exposed key becomes useless immediately.

Step 2 — Self-hosted only: note your base URL

Skip this step if TitanHQ hosts your SpamTitan.

If you self-host, copy your gateway’s address from the browser’s address bar while signed in to the admin console — just the origin, for example https://your-spamtitan.example.com. Two things matter:

• Copy it from the address bar, don’t type it from memory — a near-miss fails validation.
• It must be reachable from the internet. Conduit’s servers call your gateway directly to validate and to serve tool calls. Addresses that point at localhost, private IP ranges, or cloud metadata endpoints are rejected before any request is made — a SpamTitan box that’s only reachable on your LAN can’t be connected.

Step 3 — Connect SpamTitan in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find SpamTitan in the catalog (under Security) and click Connect. Expected: a credential form with two fields.
3. Fill the fields:
   • API Key (required) — from Step 1 (placeholder “Generate in SpamTitan admin console”).
   • Base URL (optional) — leave blank for TitanHQ-hosted (Conduit uses TitanHQ’s hosted API at https://api-spamtitan.titanhq.com); for self-hosted, enter the URL from Step 2 (placeholder https://your-spamtitan.example.com — omit for TitanHQ-hosted).
4. Click Connect. Expected: Conduit validates the key against the hosted API — or your own gateway — immediately and shows a green Connected status. A bad key or wrong base URL is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this SpamTitan connection. (For per-technician keys, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only SpamTitan tool, such as listing quarantined messages. You should get real data back, and the call appears in your audit log with the correct user, vendor (spamtitan), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid SpamTitan API key for the configured base URL.”	Either the key is wrong/revoked, or the key belongs to a different SpamTitan than the base URL points at (for example, a self-hosted key with the Base URL left blank, or vice versa). Verify both values together.
Connect fails with “SpamTitan returned HTTP <status>.”	The gateway answered with a non-auth error — a transient issue, or a Base URL that reaches a server which isn’t a SpamTitan API. Re-check the URL from your admin console’s address bar.
Base URL is rejected before SpamTitan is even contacted	The URL points at a non-public address (localhost, a private IP range, or a metadata endpoint). Conduit blocks these; the gateway must be reachable from the internet.
Tool calls return 403 “no credentials for vendor”	SpamTitan isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a key.
Need to rotate the key	Generate a new API key in the SpamTitan admin console, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.