Connect HaloPSA (First-Party MCP) to Conduit

This walkthrough connects HaloPSA (First-Party MCP) to Conduit. This vendor is unusual: instead of a Conduit-run integration container, it uses the MCP endpoint that HaloPSA itself hosts on your own tenant (at /api/mcp). You create OAuth client credentials in HaloPSA, enable the MCP endpoint, and Conduit talks to your HaloPSA instance directly.

Menu labels can change

The HaloPSA steps below reflect current flows; menu labels can shift between HaloPSA releases. If a label differs, see HaloPSA’s API credentials guide and HaloPSA’s MCP guide.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin.
• A HaloPSA administrator login (to create an API application and enable the MCP endpoint).
• To know your tenant subdomain — the first label of your HaloPSA address: for wyretechnology.halopsa.com, the tenant is wyretechnology.

Step 1 — Create client credentials in HaloPSA

1. Sign in to HaloPSA as an administrator.
2. Create an API application with client credentials sign-in, following HaloPSA’s API credentials guide. The application’s agent/permissions determine what the AI can do. Expected: a Client ID and a Client Secret, with the secret shown at creation.
3. Copy both values.

Caution

Copy the client secret now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the secret, regenerate it on the application in HaloPSA first; the exposed secret becomes useless immediately.

Step 2 — Enable the MCP endpoint in HaloPSA

Conduit uses the MCP endpoint your HaloPSA instance hosts. In HaloPSA, open Configuration → AI and turn on “Enable the MCP Endpoint” (see HaloPSA’s MCP guide). If this is off, Conduit’s connect check will tell you so explicitly.

Step 3 — Connect HaloPSA in Conduit

1. In Conduit, go to Connections (/org/catalog), find HaloPSA (First-Party MCP) (under PSA), click Connect.
2. Fill the fields:
   • Client ID — from Step 1. Required.
   • Client Secret — from Step 1. Required.
   • Tenant — subdomain only — e.g. wyretechnology for wyretechnology.halopsa.com. Required.
3. Click Connect. Expected: Conduit requests a real OAuth token from your tenant and then probes the MCP endpoint itself, so a wrong secret, a wrong tenant, and a disabled MCP endpoint are each caught here with a distinct message.

Note

This first-party integration relies on per-tenant routing that is still being rolled out in Conduit. Connecting validates and stores the credential today; if tool calls don’t route yet on your deployment, the connection will start working as the rollout completes — no reconnect needed.

Verify it worked

Ask a connected MCP client (see Connecting an AI client) to run a read-only HaloPSA tool, such as listing clients or recent tickets. Real data should come back, and the call appears in your audit log with vendor halopsa-official.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid HaloPSA tenant subdomain.”	The Tenant field must be just the subdomain label — e.g. wyretechnology — not a full URL or hostname.
Connect fails with “Invalid HaloPSA client credentials or tenant subdomain.”	The Client ID/Secret pair is wrong or revoked, or the tenant you entered isn’t the one the application was created on. Verify all three together.
Connect fails with “HaloPSA returned HTTP …”	Your tenant’s token endpoint responded unexpectedly — often transient, or the tenant subdomain points at the wrong instance.
Connect fails with “HaloPSA token response did not include an access_token.”	HaloPSA accepted the request but returned no usable token — check that the application is configured for the client credentials flow.
Connect fails with ‘HaloPSA credentials are valid but the MCP endpoint is disabled. Enable it in Configuration → AI → “Enable the MCP Endpoint” inside HaloPSA.’	Exactly what it says — Step 2 was skipped. Enable the endpoint and re-connect.
Connect fails with “HaloPSA MCP endpoint returned HTTP …”	The MCP endpoint is enabled but unhealthy, or the application lacks access to it. Check the endpoint settings per HaloPSA’s MCP guide.
Connect fails with “Could not reach Halopsa MCP endpoint: …”	Network-level failure reaching your tenant’s /api/mcp — the tenant address may be wrong or temporarily unreachable.
Need to rotate the secret	Regenerate the application’s client secret in HaloPSA, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.