read thedocs.

Keeper Security is a zero-knowledge password manager and privileged-access platform. StackJack connects to Keeper's hosted REST surfaces so your AI assistant can provision personal-vault licenses, manage MSP customer accounts, and provision users and teams.

Because Keeper's vault contents are zero-knowledge (encrypted so that not even Keeper can read them), StackJack does not touch vault records, secrets, or passwords. Instead it drives the three administrative REST surfaces Keeper exposes to partners:

• Provisioning — issue Keeper Family and Student personal-vault licenses to end users.
• MSP Account Management — for Keeper MSP/distributor partners: list managed accounts and products, read seat usage, and move accounts through the trial → paid → cancel lifecycle.
• SCIM 2.0 — provision, update, enable/disable, and deprovision users, and manage Teams (SCIM Groups) in a Keeper enterprise node.

Connecting Keeper to StackJack gives your AI assistant a family of 30 keeper_ MCP tools — MCP (Model Context Protocol) tools are the standardized commands an AI assistant can call through StackJack.

Three independent credential sets

Keeper's three surfaces authenticate separately, and each is optional — configure only the ones you use. A tenant that only issues Family plans needs the Provisioning credentials alone; the MSP and SCIM tools will report that they are "not configured" and take no action.

Each credential set only unlocks its own tools. If a tool reports the surface is not configured, add that surface's credentials on the Keeper connector — the others keep working unchanged.

Regions and custom hosts

Most tenants use the default US host (https://keepersecurity.com). StackJack shows a Region selector; choose a non-US region only if your Keeper tenant is hosted in the EU, Australia, Canada, Japan, or the US Government Cloud. Only the US host is verified end to end today; other regions follow Keeper's published data-center hosts.

If your Keeper tenant runs on a custom or self-hosted host that isn't one of the listed regions, choose Other (custom host) in the Region selector and enter your full host URL (for example https://keeper.yourcompany.com). StackJack accepts any well-formed https:// host — a public region, a self-hosted, or an on-prem deployment — as long as it uses HTTPS and carries no embedded username/password. Changing the region or host later requires re-entering the credentials for each surface you use, because Keeper credentials are tied to the host they were issued for.

Before you begin

• In StackJack: you need a role that can manage connectors (tenant Owner, a co-owner, or an Administrator).
• In Keeper: gather the credential set(s) for the surfaces you plan to use — a Partner Name/Secret from your Keeper rep, an MSP Consumer Key/Secret for MSP tools, and/or a SCIM token + node id from the Admin Console.
• Know your region if your Keeper tenant is not on the default US host.

Step 1 — Gather your Keeper credentials

1. Provisioning: ask your Keeper account representative to issue a Partner Name and Partner Secret for API license provisioning. These arrive out-of-band through a Keeper record.
2. MSP (optional): if you manage customer accounts as a Keeper MSP/distributor, ask Keeper for your MSP Consumer Key and MSP Secret.
3. SCIM (optional): in the Keeper Admin Console, open Provisioning → SCIM, enable SCIM, and copy the generated bearer token and the node id from the SCIM endpoint URL (.../api/rest/scim/v2/<node_id>).

Step 2 — Add the credentials in StackJack

1. In the StackJack portal, open Connectors.
2. Find the Keeper Security card. Click How To Connect for the steps inline, or Configure to enter credentials.
3. Choose your Region (leave the default US host unless your Keeper tenant is hosted elsewhere).
4. Fill in the credential set(s) you use — Provisioning, MSP, and/or SCIM. Leave the fields for surfaces you don't use blank.
5. Click Save.

What happens when you save

• Every credential is stored encrypted in Azure Key Vault — never in the StackJack database, and never shown back to you.
• If this is the first time you configure Keeper Security, a Free-tier subscription for the connector is created automatically so its Free tools work right away.
• StackJack live-validates whatever surface it can: if SCIM is configured it reads the SCIM service-provider config; otherwise it reads MSP products. A provisioning-only setup can't be validated without creating a real license, so it's accepted without a live call. Validation never blocks the save.

Plans and available tools

• Free includes the 14 read-only tools: list MSP accounts, products, and current/monthly seat usage; and SCIM reads — list/get users and groups, plus the SCIM service-provider config, a single resource type or schema by id, and the resource-type and schema listings.
• Pro adds the 16 write/action tools: issue Family and Student licenses; MSP account lifecycle (create trial, convert to paid, reactivate, cancel, remove); and SCIM writes — create/update/enable/disable/delete users, apply a partial patch to a user, run a batch of SCIM operations in one call, and create/update/delete Teams.

Current pricing and quotas are shown in the portal's Billing page and at checkout.

Provisioning creates real, billable licenses. The two Provisioning tools (keeper_provision_family_license and keeper_provision_student_license) issue genuine 1-year Keeper licenses on your account. Even though the underlying call is read-shaped, these are write actions — they're Pro-tier and flagged so a consent-gating AI client prompts before running them. The recipient owns the resulting personal vault and sets their own Master Password; your enterprise does not manage it. Student licenses must use a secondary/alias email domain, not your primary domain.

SCIM delete is a lock, not an erase. Deleting a SCIM user locks the account rather than permanently destroying the vault (Keeper retains it per its account-transfer policy). Deleting a SCIM Group removes the corresponding Keeper Team, but not its member users. Scope your AI's access to the delete and disable tools deliberately using the tool selections on the MCP Setup page and the Permissions page.

Rate limits

Keeper publishes no numeric quota for these APIs. StackJack applies a conservative per-tenant pace (about 60 requests per minute) and backs off on any 429, so bursts of tool calls queue briefly instead of failing.

Rotating or replacing the credentials

Each surface's credentials are its recovery secret. If a Partner Secret, MSP Secret, or SCIM token is rotated or revoked in Keeper, the matching tools stop working until you update them. Open Connectors → Keeper Security → Configure, enter the new value for the affected surface, and Save — the other surfaces are unaffected.

Troubleshooting