> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Connecting AFAS Profit to Neo > Create an app connector for Neo in Profit, link the connectors Neo needs, save its credentials in Neo, and decide what each agent can do You connect AFAS Profit once at the MSP level, then turn it on per agent. Neo connects through an **app connector**: an integration your AFAS administrator creates in Profit for Neo. The app connector decides which GetConnectors (reads) and UpdateConnectors (writes) Neo can reach, and runs as a Profit user whose rights decide what Neo can see. You need four values: your **environment number**, the **environment** (Production, Test or Accept), and the app connector's **client ID** and **client secret**. ## 1. Create the app connector in Profit Your AFAS administrator does this, following AFAS's own steps for a custom app connector ([help.afas.nl](https://help.afas.nl/help/NL/SE/120718.htm)). **1. Add the app connector** In Profit, add a custom app connector and name it so your team recognizes it, for example "Neo Agent". Pick the Profit user it runs as: Neo sees what that user may see. **2. Link the connectors Neo needs** Link these to the app connector: * GetConnector `Profit_Debtor`: your debtors, which Neo maps to your PSA clients. Neo needs it to save. * GetConnector `Profit_Subscriptions` and UpdateConnector `FbSubscription`: to read and change subscription lines. * GetConnector `Profit_Article`: to tell your items apart by their description. Link more connectors for other work, such as `Profit_Debtor_Invoices` for open invoices, or a GetConnector your administrator built. Neo reaches only what you link. **3. Choose OAuth and copy the credentials** Set the app connector's authentication to **OAuth**, with a client secret. Copy the **client ID** and a **client secret**. From Profit 9 a secret expires after 180 days by default: plan its renewal. **4. Allow Neo's addresses** If the app connector admits only listed IP addresses, add Neo's addresses: [IP whitelisting](https://docs.neoagent.io/integrations/ip-whitelisting.md). > [!NOTE] > > An app connector that still uses a **classic token** works too: pick "Classic token" as the connection type in Neo and paste the whole token, from `` to ``. AFAS expires existing classic tokens on 1 May 2027 and stops them on 31 August 2027, so move to OAuth before then. In Profit 9 you can switch an existing app connector to OAuth without making a new one. ## 2. Save the credentials in Neo **1. Open Integrations** In the Neo Dashboard, open [**Integrations** → **AFAS Profit**](https://dashboard.neoagent.io/integrations?open=afas_profit), under Accounting. **2. Enter the values** Enter your **Environment number**: the digits in your Profit address, such as `12345` in `12345.rest.afas.online`. Pick the **Environment**: Production, or Test or Accept to try Neo there first. Pick **OAuth client credentials**, paste the **Client ID** and **Client secret**, and click **Save**. Neo asks AFAS for a token and reads which connectors the app connector links before it saves. A wrong environment, a refused client ID or secret, an IP restriction that leaves Neo out, or an app connector without `Profit_Debtor` is refused on the spot, with the reason. When the secret is renewed in Profit, save the new one here. ## 3. Turn AFAS Profit on per agent Each agent decides whether it uses AFAS Profit and which areas it can touch. Open the agent, go to its **Tools & Settings** tab, click **Accounting**, and expand the **AFAS Profit** block. ### Pick a preset > [card] Read Only > > Every everyday area read only. Employees, payroll and Profit users off. The agent reads subscriptions, debtors, items, orders, invoices and projects, and never changes anything. > [card] Helpdesk > > Subscriptions, relations and dossiers read and write, each change with technician approval. Every other everyday area read only. Employees, payroll and Profit users off. > [card] IT Admin > > Every writable area read and write, subscriptions included with no approval. Finance, payroll, Profit users and setup wait on a technician. > [card] Full Automation > > Every supported write runs with no approval, finance and payroll included. A Profit user change still asks a technician. To raise subscriptions when a licence is ordered with no technician in the loop, pick **IT Admin**, or set **Subscriptions** to Read and Write with approval off. ### Or set each area by hand | Area | Access levels you can pick | Notes | | - | - | - | | **Subscriptions** | Disabled, Read Only, Read and Write | Subscriptions and their lines: what each debtor is invoiced every period (`Profit_Subscriptions`, `FbSubscription`). | | **Sales, Orders & Items** | Disabled, Read Only, Read and Write | Items and prices, stock, sales orders and quotations, packing slips, direct invoices, product groups. | | **Purchasing & Warehouse** | Disabled, Read Only, Read and Write | Purchase orders and requests, purchase prices, receipts, warehouses and stock entries. | | **Organisations, Persons & Debtors** | Disabled, Read Only, Read and Write | Organisations and persons with addresses, contacts and bank accounts, debtors and purchase contacts, appointments. | | **Dossiers & Workflows** | Disabled, Read Only, Read and Write | Dossier items, responses, tasks, workflow actions and the list of attachments. | | **Finance & Tax** | Disabled, Read Only, Read and Write | Ledger accounts, journals and entries, debtor and creditor invoices, budgets, fixed assets, cost centres, VAT codes, tax returns. These change the books as a whole, so consider approval here. | | **Projects, Hours & Flex** | Disabled, Read Only, Read and Write | Projects and phases, actual costing (hours), rates, cost estimates, Flex placements, construction and courses. | | **Employees, Leave & Recruitment** | Disabled, Read Only, Read and Write | Employees and their contracts, leave and absence, applicants and vacancies. | | **Payroll** | Disabled, Read Only, Read and Write | Wage entries, pay slips, payroll documents, and an employee's salary, tax and pension details and payroll bank account; an employee change that sets them needs this area too. Consider approval here. | | **Profit Users** | Disabled, Read Only, Read and Write | Profit users and user groups. A change always asks a technician. | | **Setup & Custom Files** | Disabled, Read Only, Read and Write | Which connectors Neo may call and their fields, the Profit version, code tables and custom files. Agents need Read Only here to look up a connector's fields. | | **Custom GetConnectors** | Disabled, Read Only | The GetConnectors your administrator built and linked to Neo's app connector. | ## Safety controls * **Two gates.** Neo reaches only the connectors you link to its app connector in Profit, and within them only the areas you turn on per agent. * **You set the approvals.** Each area has its own approval setting, so an agent can raise a subscription on its own, or ask a technician first. * **On a ticket, only that client.** On a run for a ticket, Neo reads a GetConnector that holds debtors only filtered on the ticket's client's debtor, and writes only what it can tie to that client: a subscription change, after it reads the subscription and checks it bills the client's debtor, or a new record for that debtor. Other changes, deletes, and the GetConnectors that hold every customer's records with no debtor number wait for a technician, or for a run that is not about one ticket. * **Pay is Payroll's.** An employee change that sets a salary, tax or pension details, or a payroll bank account needs the Payroll area as well, and its approval. * **Profit users always ask.** Creating or changing a Profit user grants access to your administration, so it waits on a technician whatever the setting says. * **Only documented operations.** Neo sends only the UpdateConnector writes in AFAS's published API definitions, each with its own method, and refuses any other. * **Files stay in Profit.** Neo does not download files, images or reports, and does not use AFAS's one-time-password sign-up. * **Path safety.** Neo rejects suspicious URL paths (anything that contains `..`, for example) before they reach AFAS. ## If AFAS refuses Neo's requests | What comes back | Cause | Fix | | - | - | - | | `401`, or a token error | The client secret expired or was replaced, or the app connector does not link that connector | Save a new client secret in Neo, or link the connector to the app connector. | | `403` | The app connector's IP restriction leaves Neo out | Add Neo's addresses ([IP whitelisting](https://docs.neoagent.io/integrations/ip-whitelisting.md)). | | `500` with a message | AFAS refused the data itself, such as a line that does not exist; the agent reports the message and the logbook reference | Look the reference up in the environment logbook in Profit. | | `503` | AFAS maintenance | See [afasstatus.nl](https://afasstatus.nl/) and try again later. | ## Disconnecting AFAS Profit **1. Open the integration** In the Neo Dashboard, open **Integrations** and select the AFAS Profit card. **2. Disconnect** Click **Disconnect** and confirm. Neo removes the credentials from Key Vault. To end the connection at AFAS as well, revoke the client secret or delete the app connector in Profit. Neo keeps your Organization Mapping, including any mapping you set by hand, so a later reconnect continues from the same state. Agents that use AFAS Profit stop working until you connect it again. ## Security * The client secret and the classic token are stored in Azure Key Vault, never in plaintext. * All traffic to AFAS goes over HTTPS, to your environment's address under `afas.online` only. * Write access is opt-in per agent. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.