Skip to main content

PanelOne Connect

PanelOne Connect lets your organization connect third-party apps and AI assistants to PanelOne data through a secure OAuth API and MCP server.

Public origin: https://connect.panelone.dev

This guide is for MSP owners, admins, and power users setting up integrations.

Connect is live for read access to org data — clients, devices, tickets, billing, infrastructure, identity, and reporting — plus OAuth, MCP, and permission logging. Write endpoints (portal ticket/service-request flows, quote accept, device reboot, alert acknowledge, limited CIPP actions) require explicit write scopes; vendor/device actions are staff-only. Automation and integration status reads (alert rules, outbound webhooks, custom integration runs, sync progress) and additional vendor actions (UniFi restart, NinjaOne ticket comments) are available when the relevant scopes and integrations are enabled.

This page is the public setup guide. After you create an app or API key, Settings → Developer in PanelOne shows the permissions you granted and a log of API and MCP calls.

What Connect provides​

FeatureDescription
REST APIVersioned JSON API at /v1/ — list and get org resources (clients, devices, tickets, billing, and more)
MCP serverAI tools for Claude, Cursor, ChatGPT, and other MCP clients — reads today; writes when scopes allow
OAuth 2.1User consent with PKCE; apps only get the permissions you approve
API keysMachine-to-machine keys for automation (optional alternative to OAuth)
Activity logsEvery API and MCP call is logged, including denied attempts

Connect does not expose platform-admin functions, integration passwords, or raw database access.

Who can manage Connect​

Creating apps and API keys requires the Manage developer apps permission (admin.developer.manage). Organization owners and admins receive this by default.

Any staff member with that permission can:

  • Register OAuth applications
  • Create and revoke org API keys
  • Review permission activity logs
  • Revoke app access for the organization

Customer portal users manage their own connected apps from ClientOne (profile or Connected apps). Co-managers authorize through the PanelOne consent flow with access limited to their assigned client.

Connect an MCP client (Claude, Cursor, etc.)​

MCP clients discover Connect through standard OAuth metadata at https://connect.panelone.dev.

Typical setup​

  1. In your MCP client, add a remote MCP server or custom connector pointing at:
    • Server URL: https://connect.panelone.dev/mcp
    • Resource / issuer: https://connect.panelone.dev
  2. The client reads /.well-known/oauth-protected-resource and starts OAuth.
  3. Sign in with your PanelOne (or ClientOne, for customer persona) account when the browser opens.
  4. Review the requested permissions and choose Allow.
  5. Return to the MCP client; it receives tokens and can call tools such as panelone_whoami, panelone_list_clients, or p1_devices when read scopes are granted.

Additional tools appear as you approve resource scopes during consent. Mutations (create ticket, comment, accept quote, reboot device, acknowledge alert) require write scopes; device reboot and CIPP actions require a staff persona.

Tips​

  • Use a staff account for MSP-wide data and vendor actions (device reboot, alert acknowledge, CIPP); use customer consent on ClientOne only when the integration should act as an end customer.
  • Prefer read-only scopes when the AI agent only needs to answer questions, not change data. Add write scopes only when the integration must create tickets, comments, or service requests.
  • Revoke access from Settings → Developer if you disconnect the client.

Create an OAuth application​

For a custom integration or MCP client that supports Dynamic Client Registration, registration may happen automatically when you first connect.

To pre-register an app manually:

  1. Open PanelOne → Settings → Developer.
  2. Go to the Apps tab.
  3. Select Create app.
  4. Enter a name, optional description and homepage URL, and allowed redirect URIs (must match what your integration sends to OAuth).
  5. Save. Note the client ID (and client secret if the app is confidential).

Share the client ID with your developer or paste it into the integration's OAuth settings. Redirect URIs must use HTTPS in production.

When a user authorizes the app:

  1. They are sent to https://app.panelone.dev/oauth/authorize (staff/billing/co-manager) or https://app.clientone.dev/oauth/authorize (customer).
  2. The consent screen lists requested scopes in plain language.
  3. Allow issues an authorization code; Deny returns access_denied to the app.

Approved permissions are stored as a grant. Removing the grant or revoking the app invalidates tokens.

Create and rotate API keys​

Org API keys suit server-side automation that should not use an interactive OAuth flow.

  1. Open Settings → Developer → API keys.
  2. Select Create key.
  3. Name the key and choose scopes (at minimum whoami for identity; add *.read scopes for data access and *.write only when automation must mutate data).
  4. Copy the key when shown — it is displayed only once. Store it in your secrets manager.

Keys use the prefix p1k_live_. Send them as:

Authorization: Bearer p1k_live_…

To rotate:

  1. Create a new key with the same scopes.
  2. Update your integration to use the new key.
  3. Revoke the old key in Developer settings.

Never commit API keys to source control or share them in chat.

Read permission logs​

Connect logs every REST and MCP request to permission events, including blocked calls.

  1. Open Settings → Developer → Activity.
  2. Filter by decision (allow/deny), surface (REST/MCP), app, or time range.
  3. Open a row to see route or tool name, permissions checked, HTTP status, and error codes.

Use these logs to:

  • Audit which AI tools accessed your org
  • Troubleshoot "permission denied" errors from integrations
  • Investigate unexpected API usage

Denied events include the required permission that was missing, which helps you adjust app scopes or staff roles.

Customer and co-manager users see activity for their own connected apps only, not org-wide Developer activity.

Revoke access​

ActionEffect
Revoke a grant (per user/app)Stops that user's tokens for the app
Revoke an app or clientInvalidates all tokens for that client
Revoke an API keyBlocks M2M access immediately

Revocation takes effect on the next API call; refresh tokens stop working after revocation.

What is not available through Connect​

The following stay inside PanelOne and are not offered on the public Connect API:

  • PartnerOne platform admin (managing other organizations)
  • Viewing or exporting integration passwords and vault secrets
  • Internal scheduler and background job controls
  • Direct database / PostgREST access

Vendor OAuth for Xero, QuickBooks, and WorkflowMax uses api.panelone.dev callback URLs only when an MSP brings their own developer app — that is separate from Connect app authorization. See Xero setup.

Getting help​

  • Integration errors: Check Developer → Activity for deny rows and missing permissions.
  • Staff permissions: Settings → Users & roles — ensure the authorizing user has the data access the app requests.
  • Documentation: This Connect guide, plus Settings → Developer in PanelOne.
LocationPurpose
Settings → DeveloperApps, API keys, activity (staff)
ClientOne → Profile / Connected appsCustomer authorized apps
Settings → Access logsStaff UI page views (separate from Connect API logs)