Connect ConnectWise PSA to Conduit

This walkthrough connects ConnectWise PSA (formerly Manage) to Conduit. Like ConnectWise Automate, it needs more than a simple API key — and the value most connections stumble on is the ClientID, which must be registered with ConnectWise, not made up.

Menu labels can change

The ConnectWise steps below reflect current flows; menu labels can shift between PSA releases. If a label differs, look for the nearest equivalent, or see ConnectWise’s REST developer docs and this API-key setup guide.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin.
• Admin access to your ConnectWise PSA instance (to create an API member and its public/private key pair).
• A ConnectWise-registered ClientID — see Step 1. A made-up GUID will not work, even though it looks identical.
• Your ConnectWise Company ID — the company identifier your team enters on the PSA sign-in screen.

Step 1 — Get a registered ClientID (the step people miss)

ConnectWise requires every API integration to identify itself with a ClientID issued by ConnectWise. It looks like an ordinary GUID, but PSA checks it against ConnectWise’s registry — an unregistered value is rejected no matter how correct your other credentials are.

1. Go to the ConnectWise Developer portal — ClientID page.
2. Sign in (create a free developer account if needed) and request a ClientID for a private integration, product PSA (Manage).
3. Copy the issued ClientID.

If your MSP already registered one for another PSA integration, you can reuse it.

Step 2 — Create an API member and key pair in PSA

1. In ConnectWise PSA, create (or reuse) a dedicated API member with a security role covering what you want the AI to do (read companies and tickets, create tickets, etc.). Prefer a dedicated member over a person’s login — it survives staff changes and scopes cleanly.
2. Generate a public key / private key pair for that member, following this API-key setup guide. Expected: the private key is shown once, at creation.
3. Copy both keys immediately.

Caution

Copy the private key now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the private key, delete that key pair in PSA and generate a new one first; the exposed key becomes useless immediately.

Step 3 — Connect ConnectWise PSA in Conduit

1. In Conduit, go to Connections (/org/catalog), find ConnectWise PSA (under PSA), click Connect.
2. Fill the fields:
   • Company ID — your ConnectWise company identifier. Required.
   • Public Key — from Step 2. Required.
   • Private Key — from Step 2. Required.
   • Client ID — the registered ClientID from Step 1. Required.
   • Server URL (self-hosted / regional) — optional: https://cw.example.com — leave blank for ConnectWise cloud (NA). Fill this only if you’re self-hosted or on a non-NA regional cloud. If your URL already contains an explicit /v4_6_release/... API path, Conduit uses it verbatim; otherwise it appends the standard API path for you. This direct path only works if the server is reachable from the internet with a publicly-trusted certificate — for a LAN-only server or one behind your own CA, follow the on-prem walkthrough instead.
3. Click Connect. Expected: Conduit performs a real authenticated PSA API call — sending your keys and ClientID exactly the way live tool calls will — and shows Connected only if the whole chain works.

ConnectWise PSA is Conduit’s flagship on-prem-capable vendor: it carries the Tunnel-capable badge in the catalog, so a self-hosted server that isn’t internet-reachable — or that uses an internal/private-CA certificate — can still be connected through a Conduit Tunnel. The complete zero-to-working onboarding for that case (deploy the Tunnel → connect with the Via Tunnel deployment → grant → verify) is Connect on-prem ConnectWise PSA through a Tunnel — the credential steps above (Steps 1–2) are the same; only the connect step differs.

What you can do

• Update an invoice: change fields on an invoice, such as the attention line or due date. You can preview the change before it’s saved. Ask your AI assistant to preview first, then confirm.

Verify it worked

Ask a connected MCP client (see Connecting an AI client) to run a read-only ConnectWise PSA tool, such as listing companies or recent tickets. Real data should come back, and the call appears in your audit log with vendor connectwise-psa.

Troubleshooting

The connect page runs the real authentication flow, so its error messages are diagnostic:

Symptom	Likely cause
Connect fails with “Invalid ConnectWise PSA credentials or client ID.”	One of four things: wrong Company ID, wrong public/private key pair, a disabled API member — or a ClientID that isn’t registered with ConnectWise. Get a real one at developer.connectwise.com/ClientID; a self-generated GUID will not pass.
Connect fails with “ConnectWise PSA returned HTTP …”	The server responded with an unexpected status — often a wrong Server URL, or your tenant lives on a regional cloud other than NA (set the Server URL to your region’s address).
Server URL is rejected at connect	The Server URL must be a valid, publicly reachable address — Conduit rejects unsafe or internal URLs before contacting them. Check the scheme and hostname.
Tool calls return 403 “no credentials for vendor”	ConnectWise PSA isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a credential.
Tool calls succeed but specific actions are denied	The API member’s security role doesn’t cover that action. Adjust the role in PSA — the keys inherit the member’s permissions.
Need to rotate keys	Generate a new public/private key pair for the API member in PSA, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.
• Connect on-prem ConnectWise PSA through a Tunnel — the complete onboarding for LAN-only / private-CA servers.