Validation at Save
When you click Save in the configure dialog, StackJack doesn't just file your credentials away — it checks them for common mistakes, stores them securely, and immediately tests them against the vendor's API so you know right away whether the connection works.
What happens when you save
- Pre-save checks. The dialog validates required fields and catches connector-specific gotchas before anything is stored (see below).
- Secure storage. Credentials are written to Azure Key Vault (never to StackJack's database).
- Plan activation. If this is the connector's first save, a Free subscription is created automatically.
- Live validation. StackJack makes a real, lightweight call to the vendor API with your new credentials and records the result on the connector card.
The two outcomes
- Success — a toast confirms your credentials were saved and stored in Key Vault, and the card shows Valid. You're done.
- Saved, but validation failed (or timed out) — a warning toast tells you the credentials were saved but the live test didn't pass. The save is never blocked by a failed test — your credentials are stored, the card shows the problem, and StackJack automatically re-tests in the background. If you just created the credential in the vendor product, some vendors take a moment to activate new keys; if the failure persists, re-check the values against the setup guide.
Built-in mistake guards
The dialog blocks a handful of well-known misconfigurations before saving, with a specific explanation for each:
| Connector | Guard |
|---|---|
| ConnectWise Automate | If the "Authenticator Secret" looks like a 6-digit code instead of the base32 seed, the save is blocked — the field needs the secret captured at MFA enrollment, not a one-time code. |
| CIPP | The instance URL must be the default *.azurewebsites.net App Service URL (custom domains are rejected); the API scope must contain your Application ID; and the token URL's tenant must match the Tenant ID field. |
| Liongard | Custom subdomains are checked against the allowed character set, with a live URL preview. |
| N-able N-central | The server URL must start with https://. |
| Autotask PSA | StackJack auto-discovers your Autotask data-center zone from your API user's email at save time. If zone discovery fails, the save is aborted with a specific message — nothing incorrect is stored. |
Timeouts and slow starts
Validation normally completes within about 15 seconds. CIPP is the exception: because CIPP runs on Azure Functions, a cold instance can take up to a minute to wake up, so CIPP validation waits longer before reporting a timeout.
Transient vs real failures
StackJack distinguishes between failures that mean your credentials are wrong and failures that mean the vendor was momentarily unavailable:
- Definitive failures (bad key, revoked token, missing permission) mark the credential Invalid and count toward auto-disable (see Connector Health & Auto-Disable).
- Transient failures (timeouts, vendor rate-limiting, vendor 5xx errors, a token refresh already in progress) are never counted against your credential — the background checker simply tries again later.