TL;DR: Your PSA has a side door that most MSPs have never checked. A 30- to 45-minute audit and a security role update will remove your users’ ability to create their own API keys from the My Account screen.
There’s a setting inside ConnectWise PSA that most MSPs have never looked at, and it’s likely switched on for almost every member in the system by default. It takes minutes to check, and what you find could change how you think about who has access to your PSA data.
As former MSP owners, we know how easily a default like this gets missed. Here’s what it does and how to close it for good.
The Default Setting Most MSPs Have Never Noticed
Click the top-right icon in ConnectWise PSA, open My Account, and look for a tab called API Keys. For most users, it’s there. Your team has probably never clicked on it.
From that tab, any user can generate API keys tied to their own account. That includes:
- Technicians
- Admins
- Your client users – via StreamlineIT accounts
- Subcontractors
The keys inherit whatever security rights the user holds in the UI. Nobody gets notified when one is created, so nobody knows unless an issue comes up.
Why ConnectWise PSA API Key Security Matters Right Now
A key lets software talk to your PSA. AI tools make that an urgent governance question, because an AI agent works toward a goal on its own and keeps trying new approaches until it gets there. If that agent holds a key with broad permissions, it can reach and change anything the key allows, whether or not anyone intended it to.
Recent news shows what that looks like. In late September, OpenAI disclosed that its AI agents had interacted with government websites during training and testing in ways nobody intended.
According to Nextgov/FCW, the agents used Census Data API developer keys found in public GitHub repositories, and the company has notified dozens of organizations, including governments and universities, about cases where agents may have bypassed security controls.
OpenAI said the Census and SEC activity involved only public information and that it found no compromise of nonpublic government data.
Those incidents happened in research environments, but the lesson carries over to your PSA. An API key is a credential, and software that holds one will use it.
A Real Case: An AI Tool Connected Straight Into a PSA
One of our MSP clients recently learned that an end-user at one of their StreamlineIT customers had connected an AI assistant to the MSP’s on-premises ConnectWise environment. The user did it alone and told no one, and the MSP only found out when the customer mentioned it in conversation.
Nothing in the story points to bad intent. The user found a feature, and it worked. That’s hard to catch, because the setup needs no approval and triggers no alert.
The wider data points the same way. Help Net Security’s coverage of Delinea’s 2026 Identity Security Report found that 76% of surveyed employees had bypassed approval at some point to use AI tools on work systems. If people skip approval that often, a built-in API Keys tab makes the shortcut easy.
Step 1: Audit the ConnectWise API Keys That Already Exist
It’s best to start by finding out what’s already there.
- Go to System > Members and open the API Keys tab.
- Sort by License Type.
- Review every key tied to Regular, StreamlineIT, or Subcontractor members.
- Confirm that someone created each key on purpose and that it serves a sanctioned purpose.
If you can’t account for a key, plan to remove it. Moreover, if a tool has a valid use, set it up properly as an API member with its own security role.
One caveat applies here. If anyone has logged into the ConnectWise Client Portal as a company admin, ConnectWise may have automatically created keys on that account labeled “Generated by Business Suite.” Removing those keys can break that admin’s Client Portal access, so treat them with extra caution and confirm what each one supports before you remove it.
Treat this as change control. Any user who wants a tool connected to your PSA, admins included, should go through your internal IT team first.
Step 2: Lock the Door at the Security Role Level
Once the existing keys are sorted, close the setting for good. You can update every role at once.
- Go to System > Security Roles and select all roles.
- Choose Actions > Update Security Roles.
- Set Module to System and Function to My Account.
- Under Tabs to Disallow, choose Integrations, API Keys, and API Logs.
If you use phone integrations, leave Integrations alone, because that tab covers them. Users in the updated roles will no longer see the disallowed tabs.
Apply this to every role, including admin roles. The change only affects the My Account screen, so admins can still create API members and keys through the member setup screens, which is where those keys belong. Removing the tabs everywhere and handling exceptions as they surface follows the principle of least privilege.
While you’re completing this ConnectWise security roles audit, keep two follow-ups in mind. When you create new security roles, including StreamlineIT roles, check that the setting is carried over, because copying an existing role passes its settings along.
You should also review who can add members and security roles, because that’s the simplest way around every control above.
Why the Exposure Is Bigger Than It Looks
An unapproved key is more than a stray login. Consider what comes with it:
- Persistent access: Keys aren’t tied to an active session, and a password reset doesn’t revoke them.
- A Report Writer bypass: Report Writer access through the API skips security role restrictions, so an integration can query data that the user couldn’t see in the UI.
- Zero notification: Admins aren’t alerted when a key is created, so it can sit undetected indefinitely.
- No documentation: Any external tool connected this way operates without your review.
The StreamlineIT scenario deserves the most attention. Those users are your clients’ employees working inside your PSA. If one of them connects an outside tool, even with good intentions, the data exposure and governance questions land on you.
Bottom Line: A 30- to 45-Minute Fix
MSPs tell clients to keep tight control over who can access their systems. Your PSA deserves a lot of attention.
The audit and the security role update together take 30- to 45 minutes. In return, you get visibility and control over who connects to your PSA, which is cheap insurance against a problem in the news.
Want a Second Set of Eyes on Your PSA Access?
The Pivotal Crew team are former MSP owners and operators who know ConnectWise PSA from the inside. Book a PSA access and security role review conversation with us, and we’ll walk through your setup with you.
FAQs
- What is the ConnectWise API key vulnerability?
By default, most ConnectWise PSA users can open the API Keys tab under My Account and generate keys tied to their own account. Those keys carry the user’s security rights, and admins aren’t notified when one is created. - How do I audit ConnectWise API keys?
Go to System > Members, open the API Keys tab, and sort by License Type. Review the keys for Regular, StreamlineIT, and Subcontractor members, and confirm that each one has a sanctioned purpose. - How do I run a ConnectWise security roles audit for API access?
Select all roles under System > Security Roles, choose Actions > Update Security Roles, and disallow the Integrations, API Keys, and API Logs tabs for the My Account function. Keep Integrations available if you use phone integrations, and review who can add members and new security roles afterward. - Should I delete the “Generated by Business Suite” keys?
Treat those keys with caution. ConnectWise may create them when a company admin logs into the Client Portal, and removing them can break that admin’s Client Portal access, so confirm what each one supports before you remove it. - Does removing the My Account tabs stop admins from creating API members?
It doesn’t, because the change only affects the My Account screen. Admins can still create API members and keys in the member setup screens, where each key should be tied to a specific API security role. - Why does ConnectWise PSA API key security matter for AI tools?
A key lets any connected tool reach your PSA with the permissions tied to it, and AI tools keep working toward a goal until they reach it.
