Section 1
Authentication is a design decision, not a setup step
API keys are simple and dangerous. They rarely expire, they usually carry broad permissions, and they end up in a workflow configuration several people can read. OAuth is better scoped and more work. Tokens expire, refresh has to be handled, and a refresh failure at 3am is an outage whose error message never mentions authentication. For anything running unattended, prefer a dedicated service account over a staff member's credentials. Integrations built on a founder's personal token break the week that founder changes their password, and they grant the automation everything that person can do. Scope credentials to the specific object and action, store them in a secret manager rather than in the automation, and rotate on a schedule you actually keep.
Section 2
Rate limits, retries, and the duplicate write problem
Every serious API meters you, and the limit is usually discovered in production during your busiest hour. Handle it deliberately. Read the documented limits before you build. Use exponential backoff rather than immediate retry, since retrying against a throttled endpoint extends the outage. Queue rather than fire in parallel on a batch. Then solve duplicates, because retries create them. If a write succeeds and the acknowledgement is lost, your retry creates a second record, charge, or email. The fix is idempotency: send a unique key with each write so the receiving system recognises the repeat, or check for existence first. A few lines of work, and it prevents the most damaging class of integration failure.
Section 3
Webhooks or polling, and the drift you have not planned for
Polling is simpler and always available. It costs you latency equal to the interval and consumes quota when nothing has happened. Webhooks are immediate and cheap at volume, and they require an endpoint that is always up, verifies signatures, responds fast, and tolerates duplicate deliveries. Most webhook providers deliver at least once, not exactly once. The slower problem is schema drift. A field is renamed, a value becomes nullable, an enumeration gains a member, and your integration keeps running while quietly producing wrong output. Nothing errors, because nothing was validated. Validate incoming payloads against an expected shape and alert on mismatch. Subscribe to vendor changelogs. Pin API versions where you can, and schedule the upgrade rather than being surprised by it.
Section 4
Identity is the integration problem nobody budgets for
The same customer is a contact in the CRM, a user in the product, a payer in billing, and an email address in the helpdesk, with four identifiers and at least one spelling discrepancy. Every meaningful AI automation crosses these boundaries, so it inherits your identity problem. Deciding which system is authoritative, and how records are matched, is a business decision disguised as a technical one, and skipping it produces automations that silently act on the wrong record. Choose the system of record per entity and write it down. Build one resolution step rather than repeating matching logic in each workflow. Log unmatched cases instead of guessing, and route them to a person. An unmatched record is an inconvenience. An incorrectly matched one is a customer receiving someone else's information.
Section 5
Security, permissions, and what the logs contain
NIST frames AI risk management around trustworthiness, design, evaluation, and use, and integrations are where the use boundary is set in practice, because they define what a system can reach. Grant least privilege per integration rather than per platform. Separate read and write credentials. Cap the volume any automation can write per hour, so a loop is contained rather than catastrophic. Pay attention to logs. Integration logs on an AI workflow contain the prompts, which contain the customer data. That store is in scope for your privacy obligations and probably has no retention policy. Set one. And keep an audit of what each automation wrote and when, because after an incident the first question is what did it touch, and reconstructing that from four vendors' interfaces is a long night. Team readiness is covered in [How to Train Your Team to Work with AI Tools](/blog/how-to-train-your-team-to-work-with-ai-tools).
Section 6
What the evidence says about integration
Integration is where the research suggests AI projects are actually won or lost. The MIT-affiliated GenAI Divide study found roughly 95% of generative AI pilots produced no measurable P&L impact, and traced the gap not to model quality but to tools that never integrated into real workflows. The deployments that worked were those that plugged deeply into existing systems and adapted over time (MIT NANDA via Fortune, 2025). Data readiness is the other half: Gartner predicts that through 2026, 60% of AI projects unsupported by AI-ready data will be abandoned, and notes that 63% of organisations lack, or are unsure they have, the data management practices AI requires (Gartner, 2025). The surface area is also larger than most founders assume. Smaller companies already run around 150 SaaS applications, and 52.7% of purchased licences sit idle (Zylo, 2025), which makes an integration strategy partly a consolidation strategy. The abandonment figures fit the same picture: companies scrapped an average of 46% of AI proof-of-concepts before production (S&P Global, 2025), frequently when a promising demo could not reach production systems. McKinsey's high performers are distinguished by redesigning workflows around AI rather than bolting models onto existing processes (McKinsey, 2025). Budget as much engineering effort for the connections as for the AI.
Section 7
Metrics for a connected system
Integration health is measurable and almost never measured. Track failure rate per connection, retry rate, duplicate write count, unmatched identity count, end to end latency, and time from a broken connection to someone noticing. That last one matters most. A dead integration is not loud. Records simply stop arriving, and the first person to notice is usually a customer asking why nothing happened. Put a heartbeat on every connection: if expected volume does not arrive within a window, alert. Small work, and it converts a silent failure into a ticket. For the tool layer these connections run through, see [Top AI Automation Tools for Startups in 2026](/blog/top-ai-automation-tools-for-startups-in-2026); on presenting connected data, [Digital Tools for Crafting and Sharing Your Stories](/blog/digital-tools-for-crafting-and-sharing-your-stories).