Connect Datto BCDR to Conduit

This walkthrough connects Datto BCDR (business continuity / disaster recovery) to Conduit. Datto BCDR authenticates with a Public Key / Private Key pair sent as HTTP Basic auth — there is no request signing and no timestamp involved, so you don’t have to worry about clock skew.

Menu labels can change

The Datto steps below reflect the partner-portal API-key flow at time of writing; menu labels can shift between releases. If a label differs, see Datto’s BCDR API key guide.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A Datto partner portal login with permission to manage API keys.

Step 1 — Create an API key pair in the Datto portal

1. Sign in to the Datto partner portal.
2. Create (or locate) your BCDR API keys following Datto’s BCDR API key guide. Expected: a Public Key and a Private Key.
3. Copy both values. Make sure the key is enabled and not restricted to specific appliances unless that’s what you intend — a restricted key limits what Conduit’s tools can see.

Caution

Copy the private key now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the private key, regenerate the key pair in the Datto portal first; the exposed pair becomes useless immediately.

Step 2 — Connect Datto BCDR in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Datto BCDR in the catalog (under BCDR) and click Connect. Expected: a credential form with two fields.
3. Fill the fields:
   • Public Key (required) — from Step 1.
   • Private Key (required) — from Step 1.
4. Click Connect. Expected: Conduit validates the key pair against Datto’s API immediately and shows a green Connected status. A bad pair is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this Datto BCDR connection. (For per-technician keys, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only Datto BCDR tool, such as listing BCDR devices. You should get real data back, and the call appears in your audit log with the correct user, vendor (datto-bcdr), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Datto BCDR rejected the key pair (HTTP 401)…”	The public/private key pair doesn’t match, was regenerated in the portal after you copied it, or was copied incompletely. Re-copy both values from the Datto portal and reconnect.
Connect fails with “Datto BCDR key lacks permission. Verify the key is enabled and not appliance-restricted.”	The pair authenticated but Datto returned 403 — the key is disabled or scoped to specific appliances. Enable it or widen its scope in the Datto portal.
Connect fails with “Datto BCDR returned HTTP NNN: …”	Datto’s API responded with an unexpected status — often a transient outage or maintenance. Retry after a few minutes.
Tool calls return 403 “no credentials for vendor”	Datto BCDR isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a key pair.
Vendor health shows yellow/degraded	Conduit’s health check sees Datto’s API responding slowly. Usually a transient Datto-side load spike — recovers automatically.
Need to rotate the keys	Regenerate the key pair in the Datto portal, then update the credential at /org/catalog. The old pair stops working the moment you regenerate.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.