Where to find your four ConnectWise fields.
Kyslan asks for a Company ID, a public key, a private key and the web address you sign in at. This page shows you exactly where each one comes from. It takes about a minute, and everything you create here is read-only and revocable in two clicks.
Why keys and not a login button? ConnectWise has no "sign in with ConnectWise" for outside tools. API keys are the only way it lets a product like Kyslan read your data, which is why every PSA integration asks for the same thing. The upside: a key you mint yourself is a key you can limit and revoke, and we cannot quietly widen it later.
The short version
If you already know your way around ConnectWise, this is the whole thing:
- System, Members, API Members tab. Make one with License Class API on a read-only security role. Do not use your own personal keys.
- On that member's API Keys tab, generate a key pair and copy both halves. The private one is shown once.
- Your Company ID is the company name you type at the ConnectWise login screen.
- Your ConnectWise address is the web address you sign in at: na.myconnectwise.net. Pasting the whole link from your browser bar is fine too. Your own server works.
- Paste all four into Kyslan, run the scan, then delete the API member.
Everything below is the same five steps, slower, with pictures.
Open the members list
In ConnectWise, go to System in the left navigation, then Members. You need admin rights to see it. If System is not in your menu, someone else at your company is the ConnectWise admin, and this is a two minute job to hand to them.
Diagram, not a screenshot. Your ConnectWise may be arranged a little differently by version.
Create an API member, not a person
On the Members screen there is a tab for API Members, separate from your staff. Open that tab and press the + in the toolbar to add one.
This matters more than it looks. An API member is a robot account that exists only to be read through. It sits on its own API licence class rather than taking a staff login, it cannot use the web interface, and deleting it later affects nobody. The alternative, generating keys under your own account, hands out a credential carrying your permissions, which for an admin means full write access to everything. Use the API member.
Diagram, not a screenshot. The toolbar icons vary between ConnectWise versions.
What to put in the fields
ConnectWise will ask for a handful of details. Nothing here is precious, and nothing here is visible to your clients:
| Field | What to enter |
|---|---|
| Member ID | kyslan, or anything you will recognise later |
| Member Name | Kyslan billing audit |
| Yours is fine. Nothing is sent to it. | |
| License Class | API. This is the field that keeps it off your staff licences, so do not skip it. |
| Role ID / Security Role | A read-only role. See making the role read-only below. |
| Level | Your top one, usually Corporate (Level 1), so the audit sees all your clients rather than one branch |
| Location, Business Unit | Your top level ones, for the same reason |
| Everything else | Leave the defaults |
Save it.
Generate the key pair
Reopen the API member you just saved, go to its API Keys tab and press + again. Give it a description so future you knows what it was for, something like Kyslan audit, then save.
ConnectWise now shows you two long strings. The public key and the private key. These are fields two and three on our form.
Diagram, not a screenshot. Real keys are longer than the examples shown.
Copy the private key before you close this screen. ConnectWise shows a private key once and will not show it to you again. If you lose it, no harm done, just delete the key and generate another one.
Your Company ID
This one trips people up because it sounds like a number. It is not. Your Company ID is the short company name you type into the ConnectWise login screen, above your username and password. Usually your business name with no spaces.
If nobody remembers it because the browser has been filling it in for years, log out and look at the login screen, or check the top of any ConnectWise email notification.
Diagram, not a screenshot.
Your ConnectWise address
The last field is just the web address you sign in to ConnectWise at. The bare address is enough, and pasting the whole link from your browser bar works too: https://, anything after the first slash, and a :443 port are stripped off on our side. We work out the rest from there.
| If you sign in at | Type this (the full link works too) |
|---|---|
| https://na.myconnectwise.net/v4_6_release/… | na.myconnectwise.net |
| https://eu.myconnectwise.net/v4_6_release/… | eu.myconnectwise.net |
| https://connectwise.yourcompany.com/… | connectwise.yourcompany.com |
Diagram, not a screenshot.
Running ConnectWise on your own server, or through a partner who hosts it? That works here. Type the address you sign in at, exactly like anyone else, and we find the right place to call from it. The one thing we cannot reach is an address that only exists inside your own network, because our scanner runs on the internet. If that is you, the CSV route gets you the same report.
Making the role genuinely read-only
Kyslan never writes to your PSA. Our connector can only issue read requests, and that is enforced in our code, not just promised in our marketing. But you should not have to take our word for it, and the security role on your API member is how you hold us to it.
Security roles live under System, then Security Roles. Each area can be set to Add, Edit, Delete or Inquire. Inquire means look but do not touch, and it is the only one you need to give us. Set the role you attached in step 2 to Inquire on the modules below, leave everything else off, and Kyslan physically cannot change anything whatever our code does.
| ConnectWise module | Set to | Why the audit needs it |
|---|---|---|
| Companies | Inquire | To know who your clients are |
| Finance | Inquire | Agreements and their additions, which is where unbilled seats show up, plus invoices so we can see what actually got billed and report only the gap |
| Service Desk | Inquire | The tickets, meaning the work that was done |
| Time & Expense | Inquire | The hours logged against that work |
| System | Inquire | Documents attached to agreements, so we can read the signed contract itself where there is one |
If your ConnectWise already has a read-only or reporting role, reuse it. If not, copy an existing role, name it something like Read Only API, and drop everything to Inquire.
A narrower role means a smaller report, not a failed one. If we cannot see invoices, we say so in the report rather than guessing.
Paste them into Kyslan
Back on the audit form, pick ConnectWise Manage and fill in the four fields. You do not need anything else. The developer credential ConnectWise requires of integration vendors is ours, already registered, so there is nothing further for you to create.
Your keys are encrypted the second they reach us, used only for that one scan, and deleted when it finishes. The detail is on our security page.
Turning it off afterwards
When your report lands, you can shut the door immediately and it costs you nothing:
- Delete the API key from the member's API Keys tab, or
- Delete the whole API member from System, then Members, then API Members.
Either kills our access instantly and needs nothing from us. If you later want a repeat scan, you make a fresh key. We would rather ask twice than hold a key we are not using.
If something goes wrong
"ConnectWise rejected those API keys"
ConnectWise answered, but it would not accept the keys. Either the public or private key is wrong or incomplete (check the private key was pasted whole, with no stray space at either end), or the security role on the API member has no read access at all. Fix the keys first, then the role: set the modules in the read-only section to Inquire and run it again.
"ConnectWise did not recognise that Company ID at …"
The address answered, but it has no company by that ID. Check the Company ID you type on the ConnectWise sign-in screen: it is the login company name, not your company's record number and not your domain. Then check the address, because the same Company ID on the wrong region (eu. instead of na., say) fails the same way. A public or private key pasted short can also land here.
"We found no company records"
The keys worked, so the role is the problem. The security role on the API member cannot read Companies. Set that area to Inquire and run it again.
"That doesn't look like a ConnectWise address"
The address needs to be a real, dotted web address, like na.myconnectwise.net or connectwise.yourcompany.com. https://, anything after the first slash and a :443 port are fine and get stripped off. What is refused: a bare IP address, a single word with no dots, and internal-only names such as .local or .internal.
"… is not a public ConnectWise address"
That name exists, but it points inside a private network, so we refused to send your keys to it. Use the address you sign in at from outside your network, the one that works from home or your phone. Private names, IP addresses and single-word names are refused on purpose, because our scanner reaches you over the internet. If your ConnectWise is only reachable inside your own network, the CSV route gets you the same report.
"We couldn't reach …" or "We couldn't find …"
The address did not answer, or does not exist on the public internet. Check it for typos against your browser bar, and make sure it is the address you sign in at from outside your network. If ConnectWise itself is having a bad day, wait a minute and try again.
It worked in ConnectWise but fails here
A brand new key can take a minute or two to become active across ConnectWise. Make a coffee and try once more before assuming anything is broken.
There is no API Members tab
Your ConnectWise login does not have admin rights. Whoever administers ConnectWise for you can do all of this in about two minutes, and you can send them this page.
Still stuck
Email hello@kyslan.com. It reaches the founder, not a queue. If it is easier, we will get on a call and do it with you. There is also always the CSV route, which asks for no keys at all and produces exactly the same report.