Acidni AI Gateway

Connect your AI assistant Admin console

1 · Who is connecting, and with which assistant?

Pick both and only the matching steps are shown. Sign-in happens on this domain; the assistant receives a short-lived, revocable token and nothing long-lived is stored in the AI product.

Who
Assistant

2 · Add this connector

Steps

    3 · Verify it works

    1. Ask the assistant: “Which tools can you use through Acidni?” It should list the connectors your role allows — nothing is a problem, see below.
    2. Ask it a read-only question, e.g. “How many open tickets do we have?” The answer should name its source system.
    3. Open the audit log: the call appears with your name and the decision.
    401 on connect Expected once — it is how the client discovers where to sign in. If it repeats, your Microsoft directory or Google Workspace domain is not linked to a client record yet; ask your MSP to add it.
    403 after sign-in You signed in but your role does not allow that tool, or the domain is not exposed for your site. Both are set by your MSP under Permissions.
    No tools listed The connector authenticated but nothing is licensed or granted to your role yet.
    Action "queued" Not an error — changes wait for a named person at your MSP to approve them.
    Advanced · a client that cannot run OAuth (paste an access token)

    The same bearer token you use against the gateway API — an Entra ID token in production (e.g. az account get-access-token --resource <gateway appId>) or a dev token locally. It is only used to build the URLs below; nothing is sent anywhere. The URL embeds the token — treat it like a password.

    MSP AI Gateway — the MSP's own AI.

    MSP Client Gateway — a client's AI.

    How the pieces fit together

    This hub is the control plane. Behind it, an MSP AI Gateway reaches the MSP's own systems and an MSP AI Client Gateway sits at each client site — both enrol outbound to this hub and never expose an inbound port. Every AI call crosses identity, RBAC, entitlement, and the audit log here before it reaches any on-prem system. Any MCP client that speaks streamable HTTP works — the hub advertises everything it needs (RFC 9728 protected-resource metadata, RFC 8414 server metadata, RFC 7591 dynamic registration, PKCE S256). Scopes: msp.read/msp.act for the MSP gateway, client.read/client.act for the client gateway; RBAC still applies per call. Fleet status lives in the admin console.