Connect ConnectWise Automate to Conduit

This walkthrough connects ConnectWise Automate (RMM) to Conduit. Unlike most vendors, Automate needs four values — and one of them, the ClientID, is the step most connections stumble on.

Menu labels can change

The Automate steps below reflect current ConnectWise flows; menu labels can shift between Automate patch versions. If a label differs, look for the nearest equivalent, or see ConnectWise’s developer docs.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin.
• Admin access to your Automate server (to create an integrator login).
• A ConnectWise-registered ClientID — see Step 1. A made-up GUID will not work, even though it looks identical.

Step 1 — Get a registered ClientID (the step people miss)

ConnectWise requires every API integration to identify itself with a ClientID issued by ConnectWise. It looks like an ordinary GUID, but Automate checks it against ConnectWise’s registry — an unregistered value is rejected with HTTP 403 no matter how correct your other credentials are.

1. Go to the ConnectWise Developer portal — ClientID page.
2. Sign in (create a free developer account if needed) and request a ClientID for a private integration, product Automate.
3. Copy the issued ClientID.

If your MSP already registered one for another Automate integration, you can reuse it.

Caution

Copy the value(s) now and store them safely. Don’t paste them into chat, email, or a shared document — the connect step moves them directly into Conduit, which encrypts them at rest. If a value is ever exposed, regenerate it in the vendor portal first; the exposed one becomes useless immediately.

Step 2 — Create an integrator login in Automate

1. In the Automate Control Center, create (or reuse) a dedicated integrator user for API access, with the permission classes covering what you want the AI to do (read clients/computers, run scripts, etc.).
2. Note the username and password. Prefer a dedicated account over a person’s login — it survives staff changes and scopes cleanly.

Step 3 — Connect in Conduit

1. In Conduit, go to Connections (/org/catalog), find ConnectWise Automate (under RMM), click Connect.
2. Fill the four fields:
   • Server URL — your Automate server, e.g. https://automate.example.com (no trailing path).
   • Client ID — the registered ClientID from Step 1.
   • Username / Password — the integrator login from Step 2.
3. Click Connect. Expected: Conduit performs the same token request your live tool calls will use — including sending the ClientID exactly the way Automate validates it — and shows Connected only if the whole chain works.

Verify it worked

Ask a connected MCP client (see Connecting an AI client) to list Automate clients or computers. Real data should come back, and the call appears in your audit log with vendor connectwise-automate.

Troubleshooting

The connect page runs the real authentication flow, so its error messages are diagnostic:

Symptom	Likely cause
“ConnectWise Automate rejected the Client ID (HTTP 403)”	The ClientID isn’t registered with ConnectWise (or is disabled). Get one at developer.connectwise.com/ClientID — a self-generated GUID will not pass.
“Invalid ConnectWise Automate credentials or server URL” (401/400)	Wrong integrator username/password, or the account is locked/disabled, or two-factor is enforced on it (use a dedicated integrator account exempted from interactive 2FA).
Tool calls fail with Failed to acquire token: 401 Unauthorized	The integrator password changed or the account was disabled after connecting. Reconnect with current credentials.
Tool calls fail with Failed to acquire token: 403 Forbidden	The ClientID was revoked/disabled after connecting. Verify it in the developer portal, then reconnect.
Tool calls fail with Failed to acquire token: fetch failed	Network: the Server URL is wrong or unreachable from the cloud, DNS doesn’t resolve publicly, or the server’s TLS certificate isn’t publicly trusted (self-signed). If your Automate server can’t be reached from the internet, connect it through a Conduit tunnel instead.
Firewall/IP-allowlisting note	Conduit’s outbound calls all leave from a single static IP, 20.242.40.128 — allowlist this IP in Automate if your server enforces IP restrictions. See Static egress IP. A tunnel is also available if you’d rather not open firewall access at all.

Related

• Vendor connections — credential scopes and rotation.
• Tunnels — reaching on-prem servers that aren’t internet-exposed.