Credential vault

The MSP pastes their own keys into a per-tenant vault. Before the keys save, they accept the MSP Connect Terms. We record the time.

Mechanism

ISVs start with a key that looks like blk_… and header X-API-Key. MSP credentials are entered on Bitlync, not in your frontend.

ISV console login

Console login is passwordless: a magic link, or Sign in with Microsoft. Both use the same session cookie. The email must already be seated or invited. The machine API uses X-API-Key, separate from that session.

ISV experience (Connect)

Console #/experience sets category config (PSA, RMM, Docs, CS, Commerce), recommended grants, and branding (GET|PUT /isv/experience-config). Vendors inherit the category template. Access is List, Read, and Write, and those stack. Never is its own setting. The MSP can tighten the starting verbs. Experience Preview walks Connect on the sandbox: keys, grants, boards, map, done. Getting Started on Setup is Suggest, Save, Preview, then Use MCP or Use API. After Save, copy-paste prompts follow the saved profile. Partner credentials and Production MSP Connect keys are separate. Connections lists each MSP and vendor, last sync, and sync detail. Issues gives a support blurb and a redacted request debug.

What the caller sees

Your product sends X-API-Key. It does not send the MSP’s PSA or RMM secret.

X-API-Key: blk_…

# MSP keys are not in this header.
# They sit in the per-tenant vault.

MSP credentials are entered on Bitlync, not in your app.

A sure match auto-maps. A PSA company with no ISV candidate is Match, company import from PSA, or Skip. Bulk unmatched import takes a dry_run preview. Ambiguous UNMAPPED is a human match.