Setting up members with their own connector credentials
Most connectors use one shared credential for the whole team. Three connectors — HaloPSA, NinjaOne, and N-able N-central — can instead identify each team member individually, so actions show up in the vendor's audit logs under the real person's name. This page is the team-admin checklist for getting a member connected with their own identity; the underlying mechanics are covered in Shared vs Per-User Credentials.
Admin checklist
Before a member can create a per-user connection, make sure:
- The connector has an active subscription — any tier, including Free, as long as it's active. (Some in-app dialog text still says a paid plan is required for the N-central JWT — that text is outdated; any active subscription works.)
- The shared connector is already configured on the Connectors page — a connector card only appears in the member's personal sign-ins after an admin has connected it. For HaloPSA / NinjaOne specifically, it must be configured in OAuth (Authorization Code) mode; members piggyback on that app registration and never need its secret.
- The member has tools assigned for that connector. Assign them on the Team page via Edit Tools (Managing members). A connector only appears in a member's personal sign-ins if their tool assignment overlaps it.
What the member does
Point the member at the Connectors page and their Your personal sign-ins section (there's no separate My Connectors item in the sidebar any more). Connectors that run entirely on the team-wide shared credential don't get an action card there — they're rolled up into a single "these work automatically" line — so the only cards shown are the ones that need the member's own sign-in:
| Card status | Meaning | Member action |
|---|---|---|
| Authorization Required | OAuth connector, member never connected | Select Connect, sign in on the vendor's page |
| Connected | Member has a working personal credential | None (a low-key Reconnect is available) |
| Re-authorize Required | Their personal grant was revoked or expired on the vendor side | Select Re-authorize |
For HaloPSA / NinjaOne, after the vendor sign-in completes the member lands on a one-time credentials page showing a personal MCP Client ID and Secret (displayed exactly once, for a few minutes). They should paste these into their AI tool right away — see Your personal connector sign-ins for the member-facing walkthrough.
For N-central, the member selects Set JWT (or Update JWT) on the N-central card and enters the N-central Server URL and their personal User-API Token (JWT). StackJack validates the token automatically when they save, so a bad or under-permissioned JWT is caught right away; once connected, a Test button on the card re-checks the credential any time. No separate MCP credential is minted for N-central.
How team changes interact with per-user credentials
- Editing a member's tools immediately changes which connectors they can see and use — including on existing connections.
- Revoking a member's access disables their per-user connector credentials in the same step as everything else (Managing members); reactivating restores them unless a credential was disabled for a separate reason.
- A member connecting before being approved: if a self-registered, pending member tries the per-user OAuth flow, it completes their sign-in but bounces with a "Connector Not Assigned" message — approve them and assign tools first (Approving self-registered members).