> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Connecting Keepit to Neo > Create a Keepit API token in the Partner Management Console, pick your data center and save both in Neo You connect Keepit once at the MSP level. One API token made in your partner account covers every customer account below it. ## 1. Create the API token A Keepit API token has the permissions of the user who creates it. Create it as a partner or **MSP Full Admin** user, so the token reaches every customer account. A user with a narrower role gets a "Forbidden" answer from Keepit for the accounts and actions the role does not cover. **1. Open your user's tokens** Sign in to the Keepit Partner Management Console as that user, open your user's settings and go to **Security > Secondary tokens**. **2. Add an API token** Add an API token and name it Neo. Copy its user name and password before you close the window: Keepit shows the password once. > [!WARNING] > > If the token is deleted, expires or loses its user's role, Neo loses access to Keepit until you save a new token here. ## 2. Add the token in Neo **1. Open Integrations** In the Neo Dashboard, open **Integrations** and find the Keepit card, under Backup & Recovery. **2. Pick the data center** In **Data center**, pick the one that holds your Keepit account. It is the host in the address you sign in at: | Data center | Host | | - | - | | Denmark, Copenhagen | `dk-co.keepit.com` | | Germany, Frankfurt | `de-fr.keepit.com` | | Switzerland, Zurich | `ch-zh.keepit.com` | | United Kingdom, London | `uk-ld.keepit.com` | | United States, Washington DC | `us-dc.keepit.com` | | Canada, Toronto | `ca-tr.keepit.com` | | Australia, Sydney | `au-sy.keepit.com` | Neo sends the token only to the host you pick. **3. Save the token** Paste the **API token user name** and **API token password** and click **Save settings**. Neo signs in to Keepit with them before it saves. A wrong user name or password, or the wrong data center, is rejected straight away, and so is a token that Keepit refuses API access. If you change the data center later, Neo asks for the password again. ## 3. Check the Organization Mapping tab Neo matches each Keepit customer account to a company in your PSA by name: the account's company name, then its contact's name. Open the Keepit card's **Organization Mapping** tab after the first PSA metadata sync. Confirm the suggested matches and set the right company for any account Neo matched wrongly or could not match. On a ticket, Neo reaches only the Keepit account mapped to the ticket's company, so an unmapped customer gets no Keepit calls on its tickets. [How the mapping works](/integrations/keepit/overview#your-customer-accounts-are-mapped-to-companies). ## 4. Turn Keepit on per agent Open the agent, go to its **Tools & Settings** tab, click **Backup & Recovery**, and expand the **Keepit** block. Pick one of its **Presets**, or set each area yourself: | Area | Access levels you can pick | Notes | | - | - | - | | **Customer Accounts** | Disabled, Read Only, Read / Write | Your account and the customer accounts below it, their contacts, and adding a customer account. | | **Connectors** | Disabled, Read Only, Read / Write | Each connector's health and reason, status, errors and settings; adding, renaming, re-authenticating and deleting a connector. | | **Backups and Jobs** | Disabled, Read Only, Read / Write | Backup and restore jobs with their state and errors, snapshot history, and starting a backup. | | **Restores** | Disabled, Read / Write | Starting a restore that writes backed-up items back into the client's cloud service. | | **Backup Data Search** | Disabled, Read Only | Searching and browsing backed-up mail, files, sites and users. | | **Share Links** | Disabled, Read Only, Read / Write | Links that open backed-up items to anyone with the link. | | **Legal Holds** | Disabled, Read Only, Read / Write | Legal holds and their saved searches. | | **Audit Log and Reports** | Disabled, Read Only, Read / Write | Who did what in Keepit, and requesting a compliance report. | | **Products, Licences and Usage** | Disabled, Read Only, Read / Write | Each account's product, service period, retention, quotas, and seat and storage usage. | | **Notifications and Mailbox** | Disabled, Read Only, Read / Write | The messages Keepit sends, forwarding them to your users, and each user's in-app mailbox. | | **Users, Tokens and Access** | Disabled, Read Only, Read / Write | Sign-in tokens, who can reach each connector's backup data, and SSO settings. | | Preset | What runs on its own | What asks a technician | | - | - | - | | **Read Only** | Every read | No write is allowed | | **Helpdesk** | Reads of accounts, connectors, jobs, backup data, legal holds, the audit log, usage and notifications | Starting a backup, and a restore. Share links and users stay off | | **IT Admin** | Reads, and changes to connectors, jobs, restores, legal holds, reports and products | Changes to customer accounts, share links, notifications and users | | **Full Automation** | Reads and writes in every area | Only the writes that always ask | Some writes always ask a technician, whatever the preset, and some operations Neo never sends. Both lists are in [Safety Controls](/agents/tools/backup/keepit-api#safety-controls). ## Send Keepit notifications to your PSA An agent that works Keepit alert tickets needs Keepit's notification emails to open tickets in your PSA. Keepit forwards a customer account's notifications to the users of your partner account when forwarding is on, and sends each one to that user's email address. **1. Pick the user that receives them** Use a partner user whose email address is your PSA's inbound email address, or set a mail rule that forwards that user's Keepit emails to it. **2. Turn forwarding on** In the Partner Management Console, turn on forwarded messages for your partner account. Keepit's account-wide switch is off by default. Then turn on the message types to ticket: **backup-failed**, **backup-incomplete**, **device-health-changed** (a connector's health changed) and **restore-incomplete** or **restore-failed**. **3. Check the user receives them** Each user of the partner account receives forwarded messages unless it is excluded, either for every customer account or for one. Make sure the user from the first step is not excluded. An anomaly notice (a large removal of data) goes to the customer account's own users. It opens a ticket only when one of those users' email reaches your PSA. Make sure your PSA files each Keepit ticket under the customer's company, and not your own: on a ticket, the agent reaches only the Keepit account mapped to the ticket's company. See [Keepit API](/agents/tools/backup/keepit-api) for what the agent can read and change, and example instructions. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.