> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting Todyl to Neo

> Create a Todyl External API token, allow Neo's IP addresses, and save the token in Neo

You connect Todyl once at the MSP level. The token reads every tenant (client) of your partner account.

## 1. Create an External API token

**1. Open External API Tokens**

Sign in to the Todyl partner portal and open **Account** → **Developer APIs** → **External API Tokens**.

**2. Create the token**

Click **Create Token** and give it a name such as `neo-agent`. Add one ACL row per resource, each with the action **read**:

| Resource | Needed for |
| - | - |
| `devices` | Endpoints, users and device breakdowns. Required. |
| `deployment_groups` | Mapping your tenants to companies, and breakdowns by deployment group. Required. |
| `billing.invoices` | Invoices and the devices billed on them. Optional. |

Choose an expiration, then click **Create**.

**3. Copy the Client ID and API Token**

The success screen shows the **Client ID** and the **API Token**. Copy both now: Todyl shows the token only once.

## 2. Allow Neo's IP addresses

Todyl answers only requests from your allowed source IPs, whatever the token. On the same tab, click **Manage Allowed Source IPs** and add every address on [IP Whitelisting](https://docs.neoagent.io/integrations/ip-whitelisting.md). The list applies to all your tokens, and a change takes effect on the next request.

## 3. Add the token in Neo

**1. Open Integrations**

In the Neo Dashboard, open **Integrations** and find the Todyl card, under Endpoint Security.

**2. Save the Client ID and API Token**

Paste the **Client ID** and the **API Token** and click **Save**. Neo reads one device and one deployment group with the token before saving, so a wrong token, a missing ACL row or a missing IP address is reported straight away.

## 4. Turn Todyl on per agent

Open the agent, go to the **Tools & Settings** tab, and configure the Todyl block under **Tools & Integrations**. The **Read Only** profile turns on every area. To leave an area out, set it to Disabled:

| Area | Access levels you can pick | Notes |
| - | - | - |
| **Devices** | Disabled, Read Only | Devices with their agent and protection state, and their latest session: the account signed in, MFA, and public and LAN IP addresses. |
| **Deployment Groups** | Disabled, Read Only | Deployment groups with their products and device counts. Neo removes their enrolment keys. |
| **Billing** | Disabled, Read Only | Invoices to you, each client's slice and the devices billed. Needs `billing.invoices` on the token. |

See [Todyl API](https://docs.neoagent.io/agents/tools/security/todyl-api.md) for what the agent can read.

## Set up an agent

Ask your Neo Support Agent for the agent you need, for example: "Set up a scheduled agent that sends me, every Monday, each client's Todyl devices broken down by type, operating system and deployment group, with the devices that have not checked in for a week or run an outdated agent."


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.