Skip to main content
Set up

Create the security role, API member, and keys in ConnectWise

Create a narrow security role, an API member, and a key pair in ConnectWise PSA so Lemhi can connect.

Written By The Lemhi Product Team

Last updated 1 day ago

For the MSP admin with System module access in ConnectWise PSA. When you finish, you have a security role, an API member, and a public and private key ready to enter in Lemhi.

Lemhi connects to your ConnectWise instance as an API member with a narrow security role you create. Everything in this article happens in ConnectWise PSA.

Step 1: Create a security role

The role gives Lemhi exactly the access it needs and nothing more.

  1. In ConnectWise, go to System > Security Roles.

  2. Select + (New Role).

  3. Enter a Role ID, for example Lemhi Compass API, and save.

  4. The role opens on Security Modules for Role: nine collapsible modules, where every row has four pickers (Add Level, Edit Level, Delete Level, Inquire Level). Every level starts at None.

  5. Set these four required rows. Leave every other row in every module at None.

Module

Row

Set these levels

Companies

Company Maintenance

Inquire = All

Service Desk

Service Tickets

Inquire = All, Add = All, Edit = All

System

Table Setup (customize)

Inquire = All, Add = All

System

Member Maintenance

Inquire = All

  1. Save the role.

System > Security Roles, with the new Lemhi Compass API role in the list

Check: The role saves without an error, and the four required rows above show the levels you set.

Set Inquire first. ConnectWise never lets a row's Add, Edit, or Delete level sit higher than its Inquire level. If you set Add before Inquire, the save fails with "Add, Edit and/or Delete levels cannot be at a higher access level than the Inquire level." Set Inquire = All on the row, then set Add and Edit.

Company Maintenance offers only None or All for Inquire. There is no My tier on that row. All is the value you want.

Service Tickets is one row, not three. It carries three levels. You are setting four required rows, or eight if you add the Project rows below.

Optional: Project permissions, to push tasks to ConnectWise projects

Skip this if you only want Compass tasks to become service tickets on a service board. Add these rows if you also want to push tasks to a ConnectWise project and phase. They are all in the Project module of the same role. Set Inquire first on each row.

Module

Row

Set these levels

Project

Project Headers

Inquire = All

Project

Project Phase

Inquire = All

Project

Project Notes

Inquire = All

Project

Project Tickets

Inquire = All, Add = All, Edit = All

Project Tickets is one row, not three. It carries three levels, like Service Tickets.

What each row lets Lemhi do

Row

Why Lemhi needs it

Company Maintenance, Inquire

Read your company list, so each Lemhi client can be matched to its ConnectWise company

Service Tickets, Inquire and Add

Create a ticket and read it back, including its current status

Service Tickets, Edit

Add one note to a ticket when you link an existing ticket to a Compass task

Table Setup (customize), Inquire

List your service boards and each board's statuses and teams

Table Setup (customize), Add

Register a callback on each board, so a ticket closed or reopened in ConnectWise updates its Compass task within seconds

Member Maintenance, Inquire

Let Lemhi confirm an active API member exists

Project Headers, Inquire

List the open projects of the client's ConnectWise company

Project Phase, Inquire

List each project's phases, so you can choose where the ticket lands

Project Notes, Inquire

Needed alongside Project Tickets for Lemhi to work with project tickets

Project Tickets, Inquire and Add

Create a project ticket and read it back, including its current status

Project Tickets, Edit

Add one note to a project ticket when you link an existing project ticket to a Compass task

Already connected? Edit the role you created earlier and add the levels you are missing. You do not need to reconnect in Lemhi or create new keys.

Step 2: Create an API member

  1. Go to System > Members.

  2. Open the API Members tab and select +.

  3. Fill in the member:

Field

What to enter

Member ID

A short identifier, for example lemhi

Member Name

A display name, for example Lemhi Compass

Time Zone

Your time zone

Email

Optional

Role ID

The role you created in Step 1

Level, Name, Default Territory

Your choice

Location

A location that has business units

Business Unit

Required. Pick one

  1. Save the member.

The API member's details. Role ID is the role from Step 1, and Location is set before Business Unit

Check: The member appears on the API Members tab with the Step 1 role as its Role ID.

System > Members > API Members, showing the new member and its Role ID

Set Location before Business Unit. The Business Unit list stays empty until you pick a Location that has business units. An empty list there is not a bug. Choose a Location, then come back to Business Unit.

Step 3: Create the API key pair

  1. On the member you just saved, open the API Keys tab.

  2. Select +, enter a Description (for example Lemhi), and save.

  3. ConnectWise shows a Public Key and a Private Key. Copy both now.

The API Keys tab on the member. Select + to create the key pair

Check: You have two 16-character keys copied somewhere safe.

The private key is shown only once. ConnectWise says so on the page: "The private key is only available at the time the key is created." If you lose it, delete the key pair and create a new one.

Next

Check that your service boards have a default status and team

Was this helpful?

Still need help? Ask the team