Connect NinjaOne to Conduit

This walkthrough connects NinjaOne (RMM) to Conduit. You register an API client in NinjaOne, then add its Client ID and Secret — together with your region — as an organization connection in Conduit. Once connected, any MCP client your organization uses can call NinjaOne tools through Conduit’s gateway.

NinjaOne authenticates with OAuth 2.0: the API client you register must allow the client credentials grant, and Conduit exchanges your ID and secret for a token on your region’s host.

Menu labels can change

The NinjaOne-portal steps below stay deliberately generic; menu labels can shift between NinjaOne releases. Follow NinjaOne’s OAuth token configuration guide as the authority for registering an API client.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A NinjaOne administrator login that can register API clients.
• To know your region — the NinjaOne cloud your account lives in. Credentials only authenticate against the region they were created in.

Step 1 — Register an API client in NinjaOne

1. Sign in to NinjaOne as an administrator.

2. Register an API client following NinjaOne’s guide, with these three settings:

   • Application platform — API Services (machine-to-machine).
   • Allowed grant types — Client Credentials, nothing else. (Authorization Code is the interactive browser flow — it’s also what makes NinjaOne demand a redirect URI — and Refresh Token only applies to interactive flows.)
   • Scopes — Monitoring and Management, per the table below.

   Expected: a Client ID and a Client Secret, shown at creation.

3. Copy both values.

Which grants Conduit needs

NinjaOne scope	Needed?	What it covers in Conduit
Monitoring	Required	Every read tool — listing and getting devices, alerts, device activities, organizations, and tickets. Conduit’s connect test authenticates with this scope.
Management	Required	Every write tool — resetting alerts, creating organizations, creating/updating/commenting on tickets, and scheduling device reboots.
Control	Leave off	NinjaOne’s remote-access scope (remote sessions). Conduit never opens remote sessions and doesn’t request this scope, so granting it does nothing.

Both required scopes must be on the API client from the start: Conduit’s connect test only exercises monitoring, but tool calls request both scopes — an API client without Management will connect green and then fail every tool call.

No redirect URI

There is nothing to enter as a redirect URI — Conduit talks to NinjaOne machine-to-machine and never redirects a browser through it. NinjaOne only requires a redirect URI for the Web and Single Page application types. If the form insists on one, you’ve picked the wrong application platform — switch to API Services (machine-to-machine).

Caution

Copy the secret now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the secret, regenerate the API client’s secret in NinjaOne first; the exposed secret becomes useless immediately.

Step 2 — Connect NinjaOne in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find NinjaOne in the catalog (under RMM) and click Connect. Expected: a credential form with three fields.
3. Fill the fields:
   • Client ID (required) — from Step 1.
   • Client Secret (required) — from Step 1.
   • Region (required) — pick the NinjaOne cloud your account lives in: us (app.ninjarmm.com), eu (eu.ninjarmm.com), or oc (oc.ninjarmm.com). Match it to the host you sign in to.
4. Click Connect. Expected: Conduit exchanges the credentials for a token on your region immediately and shows a green Connected status. Bad credentials or the wrong region are rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this NinjaOne connection. (For per-technician credentials, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only NinjaOne tool, such as listing organizations or devices. You should get real data back, and the call appears in your audit log with the correct user, vendor (ninjaone), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid NinjaOne client credentials or wrong region.”	The Client ID/Secret pair is wrong or revoked, the API client doesn’t allow the client credentials grant, or the region doesn’t match where the client was registered. Verify all three.
Connect fails with “NinjaOne returned HTTP <status>.”	NinjaOne’s token endpoint returned an unexpected error — often a transient NinjaOne-side issue. Retry after a moment.
Tool calls return 403 “no credentials for vendor”	NinjaOne isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has credentials.
The NinjaOne form demands a Redirect URI	Wrong application platform selected. Conduit needs no redirect URI — choose API Services (machine-to-machine), which doesn’t ask for one.
Connect shows green, but every tool call fails with an authorization/scope error	The API client allows monitoring but not management. Conduit’s connect test only uses monitoring; tool calls request both scopes, so the token request fails at call time. Add the Management scope to the API client.
Tool calls succeed but specific actions are denied	The API client’s scopes don’t cover the action. Extend the client’s scopes in NinjaOne per the OAuth configuration guide, then reconnect if a new secret is issued.
Need to rotate the credentials	Regenerate the API client’s secret in NinjaOne, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.
• NinjaOne API documentation — full API reference.