What your integrations connect
Connect your PSA, RMM, Microsoft 365, documentation, billing and AI tools once and GoTenix joins them into one client record, with Matching to confirm which client is which.
Setup wizards
Step-by-step setup wizards, here Connect Microsoft, Make GoTenix my PSA, Set up Microsoft 365, Set up Google Workspace and Connect QuickBooks. Each walks you through one connection. Not now puts a card away for now.
Microsoft 365 is not connected
A red banner near the top warns that Microsoft 365 is not connected, with a button to the Microsoft Entra ID page. Without that connection there is no Microsoft user sync, Out-of-Office awareness or identity actions.
Identity
Microsoft Entra ID is where you connect Microsoft 365, shown here Not Configured. Connect Microsoft as Admin creates three app registrations in your own Microsoft tenant in one go: an MSP Runtime app that syncs and manages your tenant, a Client Access app your clients consent to for data sync, and a Mail Auth app for your help desk and billing mailboxes. Prefer to run it yourself? The link Prefer PowerShell? Generate a script instead does the setup by hand. After setup, the Microsoft apps menu on that page holds Test Graph connection to check the connection, and Generate PowerShell script, which is the manual way to rotate the app credentials. A shared mailbox such as helpdesk@ usually cannot sign in on its own. A real user with Full Access to it connects it, and sending from it also needs Send As or Send on Behalf, granted separately in Microsoft 365.
PSA
Autotask and HaloPSA, both shown Not Configured. Connect one to bring in your tickets and customer records so you can move your service desk across. A connected PSA is a mirror. GoTenix never pushes changes back to it, the sync keeps refreshing the mirrored tickets from the PSA, and automation such as SLA timers and dispatch ignores them. When you disconnect the PSA those tickets become native and everything arms from then on.
RMM
NinjaOne is the RMM card, shown Not Configured. Connecting it brings in device management, monitoring and alerts.
Security
ThreatLocker, shown Not Configured: zero-trust application control, ringfencing and storage control. When ThreatLocker emails an elevation request to your monitored inbox, GoTenix checks it against fixed rules first, such as VirusTotal detections, a blocked script type and a file hash seen in an earlier ticket, and only then asks Elise. A request is either auto-approved with a closed audit ticket or sent to a person as a new ticket. Auto-approve is off by default, and while it is off every request becomes a ticket for human review.
Billing
Three billing tools. Pax8 syncs the subscriptions you buy through the distributor: seat counts and your partner cost per client. QuickBooks Online syncs invoices, customer records and payment tracking, and its wizard maps your products and customers and sets when GoTenix pushes invoices to the books. Stripe lets your clients save a card on your own Stripe account: the setting Let clients save a card, and charge it is off by default and adds a My Payment page to the client portal. With Stripe configured and card capture on, a client with a card on file is charged when an open invoice comes due, once that invoice has reached your accounting system, and the card payment is recorded in QuickBooks against the invoice.
Documentation
Five cards. Hudu brings a client's documentation into the portal: articles, passwords into the encrypted vault, procedures, devices and assets, expirations, domains and networks. IT Glue imports a company's documents, passwords, custom assets, configurations and domains, plus a whole-account password export for 2FA seeds. Hudu connects with a base URL and an API key, and IT Glue with an API key and a data center region. Dell TechDirect, HP Warranty and Lenovo Warranty look up warranty coverage by service tag or serial number. Each needs its own key from the maker's developer portal. Dell and HP use an API Client ID and Secret, and Lenovo uses one key sent in a header named ClientID. Dell's key is capped at 5,000 lookups a day for the whole portal.
AI
Four AI cards. Anthropic (Claude) powers Elise and is shown Configured here. OpenAI is an alternative provider. Cohere and Voyage AI upgrade Elise's knowledge-base search to hybrid vector retrieval. You paste your own provider key on each card. This tab connects providers, and the model for one feature is set under Settings, then AI Assistant.
Remote Access
Splashtop, shown Not Configured, is the Remote Access card. It takes no password and no API key, only your Splashtop team owner email. Turning it on adds a Control mark to the RMM device list that opens a Splashtop Business session on that machine in one click. See What Splashtop gives you in one click.
Browse
On this page
Why it works this way: What your integrations connect
Matching is where GoTenix confirms that the same company in your PSA, RMM, accounting, documentation, security and procurement tools is one client. The Unmatched tab shows each outside record with a Best Match and a Confidence of High, Medium or Low, and the actions Link, Other, New and Ignore. Matched lets you Change or Unlink a link, and Create recommends new organizations. Until something is connected the Unmatched and Matched tabs read No integrations are configured.
Ask Elise instead of clicking through. Say "Who are the Microsoft 365 users at Bluebird Dental?" and she lists the users synced from Microsoft. Say "When does the warranty run out on the front desk PC?" and she reads what the maker last told us, without spending a lookup. Both only read. Say "Sync everything for Bluebird Dental" and she runs the Microsoft 365, Google and RMM device syncs that client is linked to, straight away unless your admin asks for approval. Say "Find the domains in Bluebird Dental's Microsoft 365 and add them" and she adds the verified domains and looks each new one up. Each needs the matching access: viewing clients or RMM, editing clients, or creating network records. Most of these are on an MSP instance.
Card badges include Not Configured when nothing is saved, Configured when the details are saved and readable but untested, Needs attention, Incomplete with the missing field named, Secret unreadable so re-enter it, and Disconnected when someone turned it off and the saved details are kept. A card with a scheduled sync also shows its last sync.
Questions this page answers
What is the All tab?
The unified catalog of every integration, grouped by category (Identity, PSA, Billing, and so on), each shown as configured or not configured. Click any tile to open that provider's settings and connect it. QuickBooks is the one provider that also shows a live Connected state. Use this as the starting point when setting up a new tenant.
What do the status badges mean?
There are three states. Configured means credentials are saved for that provider, the normal state once you connect it. Connected is reserved for the one provider with a live health check (QuickBooks), meaning a verified live connection. Not configured means no credentials are saved yet. A small green dot on the provider logo doubles as an at-a-glance configured marker. There is no separate error or stale badge, and if QuickBooks goes dead it simply stops showing Connected and asks you to re-authorize.
How do I connect a new integration?
Go to Integrations and pick the category tab for the provider you want (All, Identity, PSA, RMM, Security, Billing, Documentation, or AI). Open the provider's card, enter the required API credentials, and click Save. Once the credentials are saved, a Test Connection card appears so you can verify them (providers with no test simply don't show that card). Credentials are stored securely in the database, not in .env files.
How does QuickBooks integration work?
QuickBooks syncs customers, invoices, estimates, payments, and products automatically. Connect via Integrations > Billing, then the QuickBooks card. The sync runs on a schedule and can also be triggered manually. GoTenix-only fields (like product categories) are never overwritten by sync.
What is customer matching?
After syncing QuickBooks customers, use the Matching page to link QB customers to GoTenix organizations. Matched customers have their invoices and billing data automatically associated.
How does customer matching work?
After syncing QuickBooks, the Matching tab shows three views: Matched (linked), Unmatched (need linking), and Create (new clients from QB). Unmatched QB customers can be linked to existing portal clients or used to pre-fill the onboarding form for new clients.
What does "Test Connection" do?
Test Connection validates your saved API credentials by making a lightweight API call to the provider. The Test Connection card only appears after credentials are saved, so save first, then test. A success message confirms the credentials work; a failure shows what went wrong (invalid key, expired token, wrong URL, and the like). Providers that have no connection test simply don't show a Test card.
What goes under Identity?
Identity providers used for SSO sign-in and for syncing the user directory into the portal. Microsoft Entra ID (Azure AD) is configured from its card here: it needs OAuth credentials plus admin consent before it can sync. Google Workspace has no card on this tab, and that is deliberate - there is no master Google connection to type, because the Google app lives on the central sign-in proxy. Each Google Workspace client grants consent once from its own Overview page, and the 'Set up Google Workspace' wizard on Integrations > All walks you through it.
How does SSO sign-in work?
Once Microsoft or Google is connected on the Identity tab and admin consent is granted, the login page shows the corresponding SSO button. New users who sign in via SSO are auto-provisioned as client users and linked to their organization by email domain. SSO never makes anyone staff automatically. Promote someone to staff via Team > Staff.
What goes under PSA?
Professional Services Automation platforms - HaloPSA and Autotask are wired today. Connecting one reads in tickets, customer records, contacts, and time entries from the PSA. Write-back is permanently off. The portal never pushes a change back to the PSA. A mirrored ticket stays read-only here until you disconnect the PSA. That disconnect is the cutover; every ticket goes native from then on. Only one PSA is active at a time.
What billing integrations are supported?
QuickBooks Online is the live accounting provider - invoices, payments, customers, and items sync bidirectionally. Xero is scaffolded but not yet implemented. Each provider exposes the same AccountingProvider contract so business code never imports the vendor SDK directly.
What goes under Documentation?
Documentation providers - Hudu is the live integration, IT Glue is scaffolded for upcoming impl. Both surface client articles, password vaults, procedures, assets, domains, and networks into the portal so techs see one unified view per client.
What do the Dell, Lenovo and HP warranty cards need?
One set of API keys each. You make them on the maker's own web site. Each card is optional. Set up only the brands you look after. Dell and HP give you an ID and a secret. Lenovo gives you one key. We send it in a header named ClientID. Nothing is looked up until at least one card is set up. Each maker has its own daily limit on lookups. You set those limits under Settings, then Administration, then Integration Sync. Dell allows 5,000 lookups a day for your whole portal. Set a limit to 0 to stop asking that maker. The card stays set up.
What does the AI tab configure?
The API keys for the AI providers the portal uses. Anthropic (Claude) is the primary provider; OpenAI can be added as an alternative, and a Voyage or Cohere key upgrades knowledge-base search to hybrid vector retrieval. The portal calls the AI provider for every Elise interaction, KB draft generation, ticket classification, and email parsing. Which model each task uses isn't set here, that lives under Settings → AI Assistant. Without a configured key, AI features are unavailable rather than failing silently.
What is Matching?
When multiple systems (M365, PSA, RMM, docs) all have a record of "Acme Corp," they need to be linked to the SAME portal client. Matching is the workspace where you confirm those links - auto-suggested matches based on domain + name, plus manual override for ambiguous cases. Three tabs: Matched, Unmatched, Create.
What does the Matched tab show?
Clients where every connected integration has a linked external record. Use it to verify the match is correct - click a row to see all the linked external IDs (M365 tenant, HaloPSA client, NinjaOne org, Hudu company, etc.). Unlink + re-link if a match is wrong.
What does Unmatched show?
External records from connected integrations that haven't been linked to a portal client yet. Each row offers suggested portal matches based on name + domain similarity. Click Match to confirm, or Create New to onboard a new client pre-filled with the external data.
When would I use Matching > Create?
When you've confirmed an external record (e.g. a new HaloPSA customer) doesn't exist in the portal yet, the Create tab opens the new-client form pre-populated with that record's name, domain, contact, and external ID - skipping duplicate entry in the source system.
What does the Sync health section show?
Every scheduled background job this integration owns, one row each: the last run's outcome and time, the next scheduled run, the cron schedule, and a 7-day pass/fail trend. The most recent failure appears under its job with a link into the system logs. Integrations with no scheduled jobs show "No scheduled syncs" - they do their work on demand when you use them, which is a fact about their shape, not a fault.
How do I read the 7-day trend strip?
Each segment is one day: green means every run that day completed, red means the day had only failures, amber means a mixed day (some runs completed, some failed), and a hollow segment means no runs happened that day. Hover a segment for the exact completed/failed counts. A hollow stretch on a job that should run often is itself a signal - check whether the schedule is paused or the cron container is down.
Why does a job say there's no per-run history?
Only jobs that write run-history rows can show a last run and a trend strip. A job marked "runs automatically in the background; there's no per-run history for this job" still executes on its schedule, it just doesn't record per-run history, so there is nothing to plot. "No runs recorded yet" is different: that job does record history but hasn't run since this instance started keeping it.
How do I get an Anthropic API key?
Go to console.anthropic.com and sign up or sign in, then open Settings > API Keys and click Create Key. Anthropic requires its own billing on that account, typically a small prepaid credit balance, before a key will actually work; add a payment method there if you haven't already. Copy the key (it's only shown once) and paste it into the Anthropic card on this page, then Save. This key is billed directly by Anthropic to your own account; GoTenix does not mark it up or resell it.
What happens if I skip this / what breaks without an AI key?
The AI assistant, chat, ticket triage, drafting, auto-summaries, and dispatch suggestions, stays completely inactive; every AI-dependent feature simply does nothing rather than erroring loudly, so it can look like the portal is just missing those features rather than needing a key. Add the key here whenever you're ready; every AI feature turns on immediately once it's saved, no restart or additional setup needed.
What does "Connect Microsoft" actually do?
It signs you in as an admin on your own Microsoft 365 tenant and creates two app registrations in your tenant: MSP Runtime, which reads your own tenant's users, devices, and security data, and Client Access, which later reads consenting client tenants. A third registration, Mail Auth, gets created afterward and is what individual mailbox connections authorize against. Nothing else on this page or in the portal's Microsoft-dependent features (mailbox connections, per-client tenant sync, dispatch calendars, CyberSentry ingest) can work until this first connection succeeds.
Was this helpful?