Vendor connections
A vendor connection is a set of stored credentials that lets Conduit broker an AI agent’s tool calls to a vendor’s API — ConnectWise, Autotask, Datto RMM, IT Glue, and the rest. This guide covers what vendors are available, where credentials live, and how to connect, rotate, and troubleshoot them.
For the step-by-step place in the onboarding flow, see MSP Onboarding § Connect vendor credentials. For how credentials are encrypted and resolved, see the Security guide.
Supported vendors
Section titled “Supported vendors”Conduit ships with no pre-configured vendors — the vendors enabled in a deployment depend on the customer’s tool stack, decided during discovery. The vendor catalog currently covers 140 integrations:
| Vendor | Slug | Category | Auth | Hosting | Get your credentials |
|---|---|---|---|---|---|
| Action1 | action1 |
Remote Monitoring & Management | API key | Container | Setup guide |
| Atera | atera |
Remote Monitoring & Management | API key | Container | Setup guide |
| ConnectWise Automate | connectwise-automate |
Remote Monitoring & Management | API key | Container | Setup guide |
| Datto RMM | datto-rmm |
Remote Monitoring & Management | API key | Container | Setup guide |
| ImmyBot | immybot |
Remote Monitoring & Management | API key | Container | Setup guide |
| ImmyBot (First-Party MCP) | immybot-official |
Remote Monitoring & Management | API key | First-party | Setup guide |
| Kaseya VSA | kaseya-vsa |
Remote Monitoring & Management | API key | Container | Setup guide |
| N-able N-central | ncentral |
Remote Monitoring & Management | API key | Container | Setup guide |
| NinjaOne | ninjaone |
Remote Monitoring & Management | API key | Container | Setup guide |
| Printix | printix |
Remote Monitoring & Management | API key | Container | Setup guide |
| SuperOps | superops |
Remote Monitoring & Management | API key | Container | Setup guide |
| SuperOps (First-Party MCP) | superops-official |
Remote Monitoring & Management | OAuth (BYOC) | First-party | Setup guide |
| Syncro | syncro-official |
Remote Monitoring & Management | OAuth | First-party | Setup guide |
| Syncro (API connector) | syncro |
Remote Monitoring & Management | API key | Container | Setup guide |
| Autotask PSA | autotask |
Professional Services Automation | API key | Container | Setup guide |
| ConnectWise PSA | connectwise-psa |
Professional Services Automation | API key | Container | Setup guide |
| Gorelo | gorelo |
Professional Services Automation | API key | Container | Setup guide |
| HaloPSA | halopsa |
Professional Services Automation | API key | Container | Setup guide |
| HaloPSA (First-Party MCP) | halopsa-official |
Professional Services Automation | API key | First-party | Setup guide |
| Kaseya BMS | kaseya-bms |
Professional Services Automation | API key | Container | Setup guide |
| Hudu (API Key) | hudu |
IT Documentation | API key | Container | Setup guide |
| Hudu (First-Party MCP) | hudu-official |
IT Documentation | OAuth | First-party | Setup guide |
| IT Glue | itglue |
IT Documentation | API key | Container | Setup guide |
| Liongard | liongard |
IT Documentation | API key | Container | Setup guide |
| Abnormal Security | abnormal-security |
Security | API key | Container | Setup guide |
| AlertOps | alertops |
Security | API key | Container | Setup guide |
| Atomus | atomus |
Security | OAuth | First-party | Setup guide |
| Bitdefender GravityZone | bitdefender |
Security | API key | Container | Setup guide |
| Blackpoint Cyber | blackpoint |
Security | API key | Container | Setup guide |
| Blumira | blumira |
Security | API key | Container | Setup guide |
| Cisco Duo | cisco-duo |
Security | API key | Container | Setup guide |
| Cisco Umbrella | cisco-umbrella |
Security | API key | Container | Setup guide |
| Cork | cork |
Security | API key | Container | Setup guide |
| CyberQP | cyberqp |
Security | OAuth | Container | Setup guide |
| DNSFilter | dnsfilter |
Security | API key | Container | Setup guide |
| ESET PROTECT | eset-protect |
Security | API key | Container | Setup guide |
| Huntress | huntress |
Security | API key | Container | Setup guide |
| Inforcer | inforcer |
Security | API key | Container | Setup guide |
| Ironscales | ironscales |
Security | API key | Container | Setup guide |
| Island Browser | island |
Security | API key | Container | Setup guide |
| Keeper Secrets Manager | keeper |
Security | API key | Container | Setup guide |
| Mimecast | mimecast |
Security | API key | Container | Setup guide |
| PagerDuty | pagerduty |
Security | OAuth | First-party | Setup guide |
| RoboShadow | roboshadow |
Security | API key | Container | Setup guide |
| RocketCyber | rocketcyber |
Security | API key | Container | Setup guide |
| Rootly | rootly |
Security | API key | First-party | Setup guide |
| runZero | runzero |
Security | API key | First-party | Setup guide |
| SaaS Alerts | saas-alerts |
Security | API key | Container | Setup guide |
| SentinelOne | sentinelone |
Security | API key | Container | Setup guide |
| SpamTitan | spamtitan |
Security | API key | Container | Setup guide |
| Telivy | telivy |
Security | API key | Container | Setup guide |
| Teramind | teramind |
Security | API key | Container | Setup guide |
| ThreatLocker | threatlocker |
Security | API key | Container | Setup guide |
| Vanta | vanta |
Security | OAuth | First-party | Setup guide |
| WatchGuard Cloud | watchguard-cloud |
Security | API key | Container | Setup guide |
| Axcient x360Recover | axcient |
Backup, Continuity & Disaster Recovery | API key | Container | Setup guide |
| Datto BCDR | datto-bcdr |
Backup, Continuity & Disaster Recovery | API key | Container | Setup guide |
| Datto SaaS Protection | datto-saas-protection |
Backup, Continuity & Disaster Recovery | API key | Container | Setup guide |
| MSP360 | msp360 |
Backup, Continuity & Disaster Recovery | API key | Container | Setup guide |
| Slide | slide |
Backup, Continuity & Disaster Recovery | API key | Container | Setup guide |
| Spanning | spanning |
Backup, Continuity & Disaster Recovery | API key | Container | Setup guide |
| Unitrends | unitrends |
Backup, Continuity & Disaster Recovery | API key | Container | Setup guide |
| Auvik | auvik |
Network Monitoring & Security | API key | Container | Setup guide |
| Azure MCP Server | azure-mcp |
Network Monitoring & Security | API key | Container | Setup guide |
| BetterStack | betterstack |
Network Monitoring & Security | OAuth | First-party | Setup guide |
| Datadog | datadog |
Network Monitoring & Security | OAuth | First-party | Setup guide |
| Domotz | domotz |
Network Monitoring & Security | API key | Container | Setup guide |
| Grafana | grafana |
Network Monitoring & Security | OAuth | First-party | Setup guide |
| Meraki | meraki |
Network Monitoring & Security | API key | First-party | Setup guide |
| PRTG | prtg |
Network Monitoring & Security | API key | Container | Setup guide |
| UISP | uisp |
Network Monitoring & Security | API key | Container | Setup guide |
| UniFi | unifi |
Network Monitoring & Security | API key | Container | Setup guide |
| ConnectWise CPQ | connectwise-cpq |
Sales & Distribution | API key | Container | Setup guide |
| Dicker Data | dicker-data |
Sales & Distribution | API key | Container | Setup guide |
| Kaseya Quote Manager | kaseya-quote-manager |
Sales & Distribution | API key | Container | Setup guide |
| PandaDoc | pandadoc |
Sales & Distribution | OAuth | First-party | Setup guide |
| Pax8 | pax8 |
Sales & Distribution | API key | First-party | Setup guide |
| SalesBuildr | salesbuildr |
Sales & Distribution | API key | Container | Setup guide |
| Alternative Payments | alternative-payments |
Accounting & Finance | API key | Container | Setup guide |
| QuickBooks Online | qbo |
Accounting & Finance | OAuth | Container | Setup guide |
| Xero | xero |
Accounting & Finance | OAuth | Container | Setup guide |
| Customer Thermometer | customer-thermometer |
CRM | API key | Container | Setup guide |
| HubSpot | hubspot |
CRM | OAuth | First-party | Setup guide |
| Salesforce | salesforce |
CRM | API key | Container | Setup guide |
| Airtable | airtable |
Productivity | OAuth | First-party | Setup guide |
| Asana | asana |
Productivity | OAuth (BYOC) | First-party | Setup guide |
| Atlassian | atlassian |
Productivity | OAuth | First-party | Setup guide |
| Box | box |
Productivity | OAuth (BYOC) | First-party | Setup guide |
| Canva | canva |
Productivity | OAuth | First-party | Setup guide |
| CIPP | cipp |
Productivity | API key | Container | Setup guide |
| CIPP (First-Party MCP) | cipp-official |
Productivity | API key | First-party | Setup guide |
| ClickUp | clickup |
Productivity | OAuth (BYOC) | First-party | Setup guide |
| Crewhu | crewhu |
Productivity | API key | Container | Setup guide |
| Dropbox | dropbox |
Productivity | OAuth | First-party | Setup guide |
| Fathom | fathom |
Productivity | OAuth | First-party | Setup guide |
| Gmail (Google Workspace MCP) | google-gmail |
Productivity | OAuth | First-party | Setup guide |
| Google Calendar (Google Workspace MCP) | google-calendar |
Productivity | OAuth | First-party | Setup guide |
| Google Drive (Google Workspace MCP) | google-drive |
Productivity | OAuth | First-party | Setup guide |
| Intercom | intercom |
Productivity | OAuth (BYOC) | First-party | Setup guide |
| Linear | linear |
Productivity | OAuth | First-party | Setup guide |
| Miro | miro |
Productivity | OAuth | First-party | Setup guide |
| Notion | notion |
Productivity | OAuth | First-party | Setup guide |
| PayPal | paypal |
Productivity | OAuth | First-party | Setup guide |
| Plaid | plaid |
Productivity | OAuth (BYOC) | First-party | Setup guide |
| PostHog | posthog |
Productivity | API key | First-party | Setup guide |
| ScalePad | scalepad |
Productivity | API key | Container | Setup guide |
| Square | square |
Productivity | OAuth (BYOC) | First-party | Setup guide |
| Time Doctor | timedoctor |
Productivity | API key | Container | Setup guide |
| TimeZest | timezest |
Productivity | API key | Container | Setup guide |
| Zapier | zapier |
Productivity | OAuth | First-party | Setup guide |
| Avanan (Legacy SmartAPI) | avanan-legacy |
Email Security & Awareness | API key | Container | Setup guide |
| Checkpoint Avanan | avanan |
Email Security & Awareness | API key | Container | Setup guide |
| KnowBe4 | knowbe4 |
Email Security & Awareness | API key | Container | Setup guide |
| Mailprotector | mailprotector |
Email Security & Awareness | API key | Container | Setup guide |
| Proofpoint | proofpoint |
Email Security & Awareness | API key | Container | Setup guide |
| Proofpoint Essentials | proofpoint-essentials |
Email Security & Awareness | API key | Container | Setup guide |
| Sherweb | sherweb |
Marketplace | API key | Container | Setup guide |
| Calendly | calendly |
Scheduling | OAuth | First-party | Setup guide |
| Alloy Navigator | alloy |
Ticketing & Helpdesk | API key | Container | Setup guide |
| Freshdesk | freshdesk |
Ticketing & Helpdesk | API key | Container | Setup guide |
| Thread | thread |
Ticketing & Helpdesk | OAuth | First-party | Setup guide |
| AWS Knowledge | aws-knowledge |
Developer Tools | None | First-party | Setup guide |
| Cloudflare | cloudflare |
Developer Tools | OAuth | First-party | Setup guide |
| DeepWiki | deepwiki |
Developer Tools | None | First-party | Setup guide |
| Figma | figma |
Developer Tools | OAuth (BYOC) | First-party | Setup guide |
| GitHub | github |
Developer Tools | API key | First-party | Setup guide |
| Hugging Face | huggingface |
Developer Tools | API key | First-party | Setup guide |
| Microsoft Learn | microsoft-learn |
Developer Tools | None | First-party | Setup guide |
| Neon | neon |
Developer Tools | OAuth | First-party | Setup guide |
| Netlify | netlify |
Developer Tools | OAuth | First-party | Setup guide |
| Sentry | sentry |
Developer Tools | OAuth | First-party | Setup guide |
| Supabase | supabase |
Developer Tools | OAuth | First-party | Setup guide |
| Twilio Docs | twilio-docs |
Developer Tools | None | First-party | Setup guide |
| Vercel | vercel |
Developer Tools | OAuth (BYOC) | First-party | Setup guide |
| Clio | clio |
Legal Practice Management | OAuth | Container | Setup guide |
| Epicor Kinetic (via CData Connect AI) | epicor-kinetic |
Manufacturing ERP | Basic (email + PAT) | First-party | Setup guide |
| IQMS / DELMIAworks | iqms |
Manufacturing ERP | API key | Container | Setup guide |
| NetSuite | netsuite |
Manufacturing ERP | API key | First-party | Setup guide |
| 3CX | 3cx |
Communications & Telephony | OAuth | First-party | Setup guide |
| Yeastar P-Series PBX | yeastar |
Communications & Telephony | API key | Container | Setup guide |
Auth — API key: credentials you paste into the connect form. Basic (email + PAT):
HTTP Basic with an account email and a personal access token. OAuth: browser
consent, no secret stored by you. OAuth (BYOC): OAuth where you register your own
client, because the upstream vendor allowlists clients individually. None: a public
documentation server that needs no credential.
Hosting — First-party: the vendor runs the MCP server; Conduit proxies to it.
Container: Conduit runs the MCP server for the vendor.
Which Hudu do I connect? Two entries exist — hudu (“Hudu (API Key)”) and
hudu-official (“Hudu (First-Party MCP)”) — and the difference is not
whether your Hudu instance is self-hosted or cloud-hosted; either entry can
target either kind of deployment. The real question is whether that specific
instance has its own MCP server turned on (Hudu Admin → External Apps → MCP —
off by default, and most instances don’t have it enabled). If you’re not sure,
or you don’t see that setting, connect with hudu — it uses a plain API key
you generate in Hudu’s own Settings, and works with every instance. Only use
hudu-official if you’ve confirmed that setting is on and you’d rather sign
in with OAuth than paste a key. The connect form for each shows this same
guidance inline.
Which ImmyBot do I connect? Two entries exist — immybot (“ImmyBot”) and
immybot-official (“ImmyBot (First-Party MCP)”). immybot is the WYRE sidecar:
an Entra app registration (tenant ID, client ID, client secret) plus the instance
subdomain. immybot-official is ImmyBot’s own MCP server, which needs ImmyBot
0.85.0 or later with MCP turned on (Show more → MCP). Create a personal access
token on that page and paste the instance subdomain or the Connector URL
(https://<instance>.immy.bot/mcp). The token acts as the user who created it.
Two different permission sets apply. Creating and using the token needs Use
personal access tokens over MCP and Create Personal Access Tokens — those only
let the client connect. They do not let execute, get, cancel, or
start_session / end_session run. Those action and session tools also need
Run Arbitrary Scripts on the tenant or computer the AI is targeting, the same
permission that gates the Script Editor and the computer Terminal. OAuth
sign-in is not offered on this connector yet.
Each “Setup guide” link goes to the vendor’s own documentation for creating API credentials — not a generic API reference. The connect form for each vendor lists the exact fields required, and shows the in-product navigation path for obtaining each credential inline.
Each vendor’s required credentials (API key, secret, OAuth, etc.) are shown on its connect form — see Connecting a vendor below. Adding a catalog vendor not listed here is a development task — see the engineering vendor-integration guide. A vendor whose every customer runs their own MCP server at their own URL still belongs in the catalog — 3CX (Communications & Telephony) is one: you paste your PBX’s MCP URL and Conduit discovers its OAuth endpoints. For a server with no catalog entry at all (an internal tool, a one-off), see Bring Your Own MCP Server, which needs no development work.
Credential scopes
Section titled “Credential scopes”A vendor credential can be stored at one of four scopes. When a tool call runs, Conduit resolves the credential by walking the scopes in order (see the credential resolution hierarchy):
- Personal — the individual user’s own credential.
- Team — a named org credential bound to one or more teams (resolves across all of your teams; if more than one has a match, the first by name wins). For teams not yet migrated to a named key, an older per-team credential still applies — that one only resolves when you’re in exactly one team that has it configured.
- Organization — the org’s shared credential; the common case for an MSP that uses one vendor account.
- Service client — a credential bound to a machine-to-machine service client (requires org-admin role to create).
Most MSPs configure vendors at the organization scope so every technician shares one vendor account. Personal credentials are a narrower fallback for org-less users — technicians who belong to an organization no longer self-serve a personal credential (see Who can connect a vendor below); an org admin connects it at the organization scope instead.
Connecting a vendor
Section titled “Connecting a vendor”From the connections page at /org/catalog:
- API-key vendors (most of the catalog) — click Connect next to the vendor and enter the required fields (API key, secret, subdomain, etc. — the exact fields depend on the vendor’s auth type in the table above).
- OAuth vendors (Xero, QuickBooks Online, Calendly) — click Connect and complete the OAuth flow in the browser. Conduit stores the access and refresh tokens, encrypted, and refreshes them automatically when they expire.
- OAuth vendors with Dropbox sign-in (Dropbox): once Dropbox sign-in is set up, click Connect and approve on Dropbox. Until then, Connect still asks for an app key and secret. A connection that still uses a pasted app key keeps working until November 9, 2026. Once Dropbox sign-in is available, organization admins see a banner on that connection with Reconnect with Dropbox. See the Dropbox guide.
- Bring-your-own-client OAuth vendors (Asana, Box, Figma, ClickUp, Intercom, Square, Vercel, Plaid) — these vendors have no WYRE-shared app, so each org registers its own OAuth app with the vendor and pastes its credentials into the connect form (which also shows the redirect URI to register). Asana, Box, and Figma issue a client secret — the form asks for both a client ID and client secret. ClickUp, Intercom, Square, Vercel, and Plaid only support public OAuth clients (no client secret, PKCE-authenticated) — the form asks for a client ID only. Conduit encrypts any tenant secret at rest, starts the OAuth flow with that org’s own app, and reuses the same stored credentials to refresh tokens automatically — otherwise these vendors behave like any other OAuth connection.
Conduit validates a credential against the vendor’s API at connect time where the vendor supports it, so a bad key is caught immediately rather than on first tool call.
Who can connect a vendor
Section titled “Who can connect a vendor”Connections are shared at the organization level, so clicking Connect resolves differently depending on your role:
- Org-less users — connect a personal credential directly, the same as before. There’s no organization to share it with.
- Org admins — Connect routes straight to the organization scope: automatically, if you administer exactly one org, or with a page to pick which org, if you administer more than one.
- Org members (non-admin) — Connect is blocked with a “managed by your organization” message. Ask an org admin to connect the vendor; once they do, you get access automatically based on your organization’s access settings.
The one exception is m365, which is per-user by design (personalOnly) and always connects as a personal credential regardless of org membership.
Credentials can also be set via the API — see POST /api/orgs/:orgId/credentials/:vendor.
Rotating credentials
Section titled “Rotating credentials”When a vendor API key is rotated on the vendor side, update the stored credential at the matching scope:
- Org-level —
/org/catalog - Team-level — the team-filtered Catalog (
/org/catalog?team=<teamId>), reached via the team’s Connections button on/org/teams - Personal —
/settings/profile
Conduit encrypts the new credential and uses it immediately; the old one is overwritten. There is no separate “rotate” action — re-connecting overwrites in place.
Disconnecting a vendor
Section titled “Disconnecting a vendor”To remove a stored credential entirely (rather than rotate it), disconnect it at the matching scope:
- Org-level — click Disconnect next to Manage on the vendor’s card at
/org/catalog(org-admin only; members don’t see this action). - Personal — disconnect your own connection from the catalog,
/settings/profile, or the “Disconnect your personal connection instead” link on an already-connected vendor’s connect page.
Both paths ask for confirmation before deleting the credential, and the disconnect is recorded in the audit log.
Troubleshooting connection failures
Section titled “Troubleshooting connection failures”| Symptom | Likely cause |
|---|---|
| Tool calls return 403 “no credentials for vendor” | No credential is configured at any scope the user can resolve. Connect the vendor at the org scope, or check the user is in a team that has one. |
| Tool calls fail with an upstream auth error | The stored credential is stale or was rotated on the vendor side. Re-connect at /org/catalog. |
| OAuth vendor stops working after a while | The refresh token was revoked (password change, app uninstalled at the vendor, consent withdrawn). Re-run the OAuth connect flow. |
| Connect-time validation fails immediately | The key/secret is wrong, or the vendor account lacks API permissions. Verify the credential directly against the vendor’s portal. |
| A tool is missing for a connected vendor | A tool allowlist may be restricting it for the user’s role — see /org/tool-access. |
| Vendor rejects the source IP (firewall or API-key allowlist) | Conduit’s outbound calls leave from one static IP, 20.242.40.128. Allowlist it on the vendor firewall or API key. See Static egress IP. |
| Meraki organization requires an IP allowlist | Organization IP restrictions are not enforced on Cisco’s hosted MCP. Organizations that require IP allowlisting should not use this connect path. Allowlisting Conduit’s static egress IP does not turn that restriction back on. |
| A connected vendor shows no tools at all for members, but every tool Conduit lists for the vendor for an owner | On a server you connect yourself, tools that aren’t classified yet need Admin, so members see nothing. On a catalog server WYRE runs, those tools still work at the level the server describes. On a catalog server the vendor builds and supports, a tool the server has described works at that level, and a tool the server has not described stays off until an admin grants Write or Admin. A hosted server that is not on that list stays closed until you grant access, and an unclassified tool needs Admin. See Why can org owners see a vendor’s tools when members can’t?. |
| A per-tenant vendor’s catalog card sits on “Checking…” and never turns green | Expected. Vendors that run at your URL (3CX, Hudu, NetSuite) are excluded from the global health sweep, which has no tenant credentials to probe with — see Vendor health. It is not an outage, and the vendor is not counted as not-responding on the status page. |
If a vendor is reachable but a specific call misbehaves, the audit log records every tool call with its status code — a fast way to confirm whether the failure is auth, the vendor, or the tool itself.
Frequently asked questions
Section titled “Frequently asked questions”Which vendors can I connect to Conduit?
Section titled “Which vendors can I connect to Conduit?”Conduit ships with a catalog spanning RMM, PSA, documentation, security, email security, network, BCDR, productivity, sales, accounting, and marketplace tools — ConnectWise, Autotask, Datto RMM, IT Glue, and many more. No vendors are pre-configured; the ones enabled in a deployment depend on the MSP’s tool stack, decided during discovery.
Where are vendor credentials stored, and at what scope?
Section titled “Where are vendor credentials stored, and at what scope?”A vendor credential can be stored at one of four scopes — personal, team, organization, or a machine-to-machine service client. Most MSPs configure vendors at the organization scope so every technician shares one vendor account. Personal credentials are for org-less users; technicians who belong to an org connect at the org scope (an admin connects it, or an admin’s Connect click is routed there automatically) rather than minting their own.
How do I rotate a vendor API key?
Section titled “How do I rotate a vendor API key?”Re-connect the vendor at the matching scope — org-level at /org/catalog, team-level via the team-filtered Catalog (/org/catalog?team=<teamId>, reached from /org/teams), or personal at /settings/profile. Conduit encrypts the new credential and uses it immediately, overwriting the old one; there is no separate rotate action.
Why do my tool calls return “no credentials for vendor”?
Section titled “Why do my tool calls return “no credentials for vendor”?”No credential is configured at any scope the user can resolve. Connect the vendor at the organization scope, or check that the user is in a team that has one. The audit log records every tool call with its status code, which helps confirm whether a failure is auth, the vendor, or the tool.
How do OAuth vendors like Xero stay connected?
Section titled “How do OAuth vendors like Xero stay connected?”For OAuth vendors (Xero, QuickBooks Online, Calendly), Conduit stores the access and refresh tokens, encrypted, and refreshes them automatically when they expire. If an OAuth vendor stops working, the refresh token was likely revoked by a password change, app uninstall, or withdrawn consent — re-run the OAuth connect flow.
Why do some vendors ask me to register my own OAuth app?
Section titled “Why do some vendors ask me to register my own OAuth app?”Asana, Box, Figma, ClickUp, Intercom, Square, Vercel, and Plaid have no shared WYRE app to connect through, so they use bring-your-own-client (BYOC) OAuth: register an app in the vendor’s own developer console, then paste its credentials into the connect form (which shows the redirect URI to register with the vendor). Asana, Box, and Figma ask for a client ID and client secret; ClickUp, Intercom, Square, Vercel, and Plaid only support public OAuth clients, so the form asks for a client ID only (PKCE handles the rest). Conduit encrypts any client secret at rest and reuses your stored credentials to refresh tokens automatically, the same as any other OAuth vendor. Dropbox uses Dropbox sign-in against Dropbox’s official server once that sign-in is set up on this cell. Until then, Connect still asks for an app key and secret. A connection that still uses a pasted app key keeps working until November 9, 2026. Once Dropbox sign-in is available, organization admins see a banner on that connection to reconnect.
My vendor isn’t in the catalog at all — can I still connect it?
Section titled “My vendor isn’t in the catalog at all — can I still connect it?”Adding a vendor to the catalog is a development task (see the engineering vendor-integration guide) — and that includes vendors where every customer runs their own instance: the catalog handles per-tenant servers by asking for your instance’s URL and discovering its OAuth endpoints, which is how 3CX’s native MCP server (Communications & Telephony) connects. For a server that genuinely has no catalog entry — an internal tool, a one-off — use Bring Your Own MCP Server: paste its MCP endpoint URL and Conduit handles OAuth discovery, then discovers the server’s tools and assigns each one a permission tier automatically. Catalog vendors are tiered differently — from a curated classification maintained by WYRE rather than an automatic one — so a newly added catalog vendor can briefly have tools that aren’t classified yet. See Why can org owners see a vendor’s tools when members can’t? for what that looks like.
Why can org owners see a vendor’s tools when members can’t?
Section titled “Why can org owners see a vendor’s tools when members can’t?”On a server you connect yourself, a tool Conduit hasn’t classified into a permission tier requires the admin tier. Organization owners bypass that check and see all tools Conduit lists for the vendor, so that server looks complete to an owner and empty to everyone else. On a catalog server WYRE runs, a tool that isn’t classified yet still works at the level the server describes. Something the server describes as deleting or overwriting data stays off until an admin grants Admin, and a tool the server has not described needs Write. On a catalog server the vendor builds and supports, a tool the server has described still works at that level, and a tool the server has not described stays off until an admin grants Write or Admin. A tool that is already classified uses that classification. On any other server, including a hosted server that is not on that catalog list, an unclassified tool needs Admin, and there is no access until you grant it. On a server that moves money or sends email or messages, everyone starts read-only, and an admin can allow changes. This is not a tool allowlist and not a broken credential — re-connecting won’t change it. Classification ships centrally with Conduit. If members still see nothing on a server you connected yourself, contact support with the vendor slug rather than changing anything on your side.