Skip to main content
You connect UniFi once at the MSP level, then turn it on per agent. Setup takes a few minutes.
UniFi uses a single Site Manager API key per MSP. Save it once and every agent that has UniFi permissions can use it.

​
1. Create an API key in UniFi Site Manager

1

Sign in to unifi.ui.com

Use the UI account that manages your customers’ consoles. The key sees exactly the consoles that account can manage — for an MSP that is usually the organization owner account.
2

Create the key

Open Settings → API Keys and click Create New API Key.
Copy the key somewhere safe once it’s generated — UniFi shows it only once.

​
2. Add the credentials in Neo

1

Open Integrations

In the Neo Dashboard, open Integrations and find the Ubiquiti UniFi card under Networking.
2

Save the API key

Paste the key and click Save. Neo checks it against Site Manager before storing it.

​
3. Turn UniFi on per agent

Each agent decides whether it uses UniFi and which areas it can touch. Open the agent, go to the Integrations section, and configure the UniFi block.

​
Pick an access profile

Read Only

Every area set to read only. The agent can look up consoles, sites, devices, clients, networks and firewall rules, but never makes changes.

Helpdesk

Hotspot Vouchers and Clients read and write — issuing a voucher goes through on its own; authorizing a guest still waits on a technician. Devices, networks and firewall read only.

IT Admin

Every writable area read and write, but every write waits on a technician. A cautious rollout tier.

Full Automation

Issuing vouchers goes through on its own. Device restarts, network or firewall changes, guest authorization and voucher deletion still always require technician approval — that never turns off.

​
Or set each area by hand

​
Safety controls

  • Device restarts, adopt/unadopt, PoE power-cycles, every network or firewall change, guest authorization and voucher deletion always wait on a technician. This holds regardless of the agent’s automation level or the access profile you picked.
  • Consoles & Sites is always read only. Site Manager’s cloud API exposes no write for it.
  • Only the Network application is reachable. Protect (cameras) and other UniFi applications are not exposed to agents.
  • Path safety. Suspicious URL paths (anything containing .., for example) are rejected before they reach UniFi.
  • Company mapping. Each UniFi site is matched to a PSA company by name during each PSA metadata sync; review or fix matches on the card’s Organization Mapping tab.
  • Rate limiting. Neo paces calls to Ubiquiti’s limit of 100 requests per minute per console.

​
If UniFi refuses Neo’s requests

Until it is fixed, agents that use UniFi report the failure on the ticket they were working. The rest of Neo keeps running.

​
Security

  • The API key lives in Azure Key Vault. It is never stored in plaintext.
  • All traffic goes over HTTPS to api.ui.com; per-console calls are proxied by Ubiquiti’s cloud Connector, so Neo never connects to a console directly.
  • Write access to UniFi is opt in per area, per agent.
Once your credentials are saved and an agent has permissions, the UniFi tool is added to that agent automatically.