Connect ConnectWise CPQ to Conduit

This walkthrough connects ConnectWise CPQ (formerly Sell / Quosal) to Conduit. CPQ needs three values, not one: a tenant access key that you read out of your own Sell URL, plus a public key / private key pair generated inside CPQ. Unlike ConnectWise PSA, CPQ needs no ClientID.

Menu labels can change

The CPQ steps below reflect current flows; menu labels can shift between releases. ConnectWise’s own CPQ developer documentation (developer.connectwise.com) is behind a free developer-account login, so if a label differs, look for the nearest equivalent or check the connectwise-cpq-mcp credentials reference.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin.
• CPQ 2022.2 or newer. API-key authentication does not exist on older releases.
• A CPQ user flagged as an API user. Keys inherit that user’s permissions, and a key on a non-API user is rejected.
• Admin access to Settings → Organization Settings in CPQ (to create the key pair).

Step 1 — Read your access key out of the Sell URL

The access key identifies your CPQ tenant. It is not your PSA Company ID and not an email address — it lives in the URL of your own CPQ session.

1. Sign in to CPQ / Sell in a browser.
2. Look at the address bar. The URL looks like https://connectwise.quosalsell.com/QuosalWeb/home?accesskey=<accessKey>…
3. Copy the value of the accesskey parameter. Expected: an opaque tenant key, the same for everyone in your organization.

Step 2 — Create an API key pair in CPQ

1. In CPQ, go to Settings → Organization Settings → API Keys.
2. Create a new key for a user that is flagged as an API user. Prefer a dedicated API user over a person’s login — it survives staff changes and scopes cleanly.
3. Copy the public key and the private key. Expected: the private key is displayed once, at creation, and never again.

Caution

Copy the private key now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the private key, delete that key pair in CPQ and generate a new one first; the exposed key becomes useless immediately.

Step 3 — Connect ConnectWise CPQ in Conduit

1. In Conduit, go to Connections (/org/catalog), find ConnectWise CPQ (under Sales), click Connect.
2. Fill the fields:
   • Access Key — from Step 1. Required.
   • Public Key — from Step 2. Required.
   • Private Key — from Step 2. Required.
3. Click Connect. Expected: Conduit performs a real authenticated CPQ API call — sending your keys exactly the way live tool calls will — and shows Connected only if the whole chain works.

There is no server-URL field: CPQ is a single global service (sellapi.quosalsell.com) and your tenant is selected by the access key, so there is nothing regional or self-hosted to configure.

What your AI client can do

CPQ contributes 25 tools, all prefixed cpq_:

Area	Read	Write
Quotes	cpq_search_quotes, cpq_get_quote, cpq_get_quote_versions	cpq_create_quote_from_template, cpq_update_quote, cpq_delete_quote, cpq_delete_quote_version
Line items	cpq_search_quote_items, cpq_get_quote_item	cpq_create_quote_item, cpq_update_quote_item, cpq_delete_quote_item
Tabs / sections	cpq_search_quote_tabs	— (tabs are read-only over the CPQ API)
Customers on a quote	cpq_list_quote_customers	cpq_update_quote_customer, cpq_delete_quote_customer
Payment / financing terms	cpq_list_quote_terms	cpq_create_quote_term, cpq_update_quote_term, cpq_delete_quote_term
Lookups	cpq_list_templates, cpq_list_tax_codes, cpq_list_recurring_revenues, cpq_list_users	—
Diagnostics	cpq_test_connection	—

Write tools require a connection whose access tier is write or higher; the five cpq_delete_* tools and cpq_update_quote carry destructive warnings and ask your client to confirm before running.

Notable CPQ API constraints

These are limits of the ConnectWise CPQ REST API itself, not of Conduit — worth knowing before you ask an AI client to do something it can’t:

• Quotes can only be created by copying. There is no “new blank quote” endpoint. cpq_create_quote_from_template copies an existing template or quote (cpq_list_templates shows the candidates) and then renames the copy. Build your net-new quotes from a template.
• Updates are RFC 6902 JSON Patch, not merge-patch. The update tools accept a plain fields object and translate it into replace operations for you, but a raw patch array is also accepted if you need add, remove, or move.
• No publish / deliver / e-sign. Order Porter delivery, PDF generation, and porting a won quote into PSA all happen in the CPQ web app or the CPQ↔PSA integration engine. Conduit can read and change the orderPorter* / status fields on a quote, but there is no publish verb.
• No product catalog or live distributor pricing. Products enter a quote as line items; Etilize/distributor price sourcing is not exposed over REST.
• No global customer directory. Customer records exist only in the context of a quote (they sync from your CRM/PSA), which is why the customer tools are all quote-scoped.
• No opportunities. The link is the crmOpportunityId field on a quote — connect ConnectWise PSA alongside CPQ for the opportunity side.

Verify it worked

Ask a connected MCP client (see Connecting an AI client) to run a read-only CPQ tool, such as cpq_list_tax_codes or a quote search. Real data should come back, and the call appears in your audit log with vendor connectwise-cpq.

Troubleshooting

The connect page runs the real authentication flow, so its error messages are diagnostic:

Symptom	Likely cause
Connect fails with “Invalid ConnectWise CPQ access key or API key pair.”	CPQ rejected the credentials (HTTP 401). Re-read the accesskey parameter from your Sell URL, confirm the key pair was copied whole, and confirm the key’s user is flagged as an API user.
Connect fails with “ConnectWise CPQ returned HTTP 500.”	CPQ answers a missing or malformed Authorization header with 500 rather than 401 — so this usually means one of the three fields is blank or contains stray whitespace. It can also be a genuine CPQ-side error; retry once before digging.
Connect fails with “ConnectWise CPQ returned HTTP 4xx/5xx” (other)	The API responded with an unexpected status. Check CPQ availability, then confirm your tenant is on 2022.2+ — older releases have no API-key auth.
Tool calls return 403 “no credentials for vendor”	ConnectWise CPQ isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a credential.
Tool calls succeed but writes are denied	The connection’s access tier is read-only, or the CPQ user behind the key pair lacks permission. Raise the tier in Conduit, or adjust the user in CPQ — the keys inherit that user’s permissions.
Need to rotate keys	Create a new key pair in Settings → Organization Settings → API Keys, update the credential at /org/catalog, then delete the old pair in CPQ.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Connect ConnectWise PSA to Conduit — the PSA side; pair it with CPQ for opportunities and order porting.
• Security — how Conduit encrypts and resolves the credential you just stored.