Authorization

A

Admin Console Access

Who can sign into /admin pages and how. The legacy admin token always works as a fallback; enabling SSO below lets internal employees sign in through the same ConnectWise STS used by the partner-facing widgets, gated by the allow-list.

Disabled

Enable SSO sign-in

Shows a "Sign in with ConnectWise" button on the admin login gate. Requires the STS app registration fields below to be filled in.

Authorization endpoint

Token endpoint

Userinfo endpoint

Callback URL

Client ID

Scope

The client secret is never edited here - it's read server-side from the ADMIN_AUTH_CLIENT_SECRET secret, same convention as the clientSecretRef fields on the other two tabs.

Allowed admin emails

Internal employee emails allowed to sign in via SSO. The admin token bypasses this list entirely.

H

CW Home Silent Login

Silent (prompt=none) authorization-code + PKCE flow a hidden iframe on the CW Home widget uses to resolve a real partner identity without ever showing a login screen. Issuer is the Home STS per environment (e.g. int.sts.connectwisedev.com).

Disabled

P

Platform Silent Login

Same silent OIDC pattern as CW Home, for the Asio Platform widget. Issuer is the Platform STS per environment (e.g. sts.connectwisedev.com) - kept fully independent so either surface can be enabled, rotated, or disabled without touching the other.

Disabled