NinjaOne: prepare a read-only API client app

StatusComing soon

Short answer: in NinjaOne, go to Administration > Apps > API, open Client App IDs and add an app with the platform API Services (machine-to-machine), the scope Monitoring only, and the grant type Client Credentials. Copy the client ID and the client secret (shown once).

Steps

1. Sign in to NinjaOne as an administrator.
2. Go to Administration > Apps > API and open the Client App IDs tab. Click to add a new app.
3. Choose the application platform API Services (machine-to-machine).
4. Name it "StackTether". Leave redirect URIs empty (there is no user sign-in in this flow).
5. Under scopes, tick Monitoring only. Monitoring is read-only access to monitoring data and the organization structure. Do not tick Management (changes devices and organizations, runs scripts) or Control (remote access).
6. Under allowed grant types, tick Client Credentials.
7. Save, then copy the client ID and the client secret into your password manager. The secret is shown only once.
8. Note your NinjaOne instance address (the address you sign in at, which depends on your region).

Official reference: NinjaOne Public API reference (authorization and application registration). Labels can move between NinjaOne releases; look for the platform, scope and grant type names above.

Rotate and revoke

• Rotate: create a new client app or a new secret, replace it in StackTether, then remove the old one.
• Revoke: delete the client app under Client App IDs.

FAQ

Why only Monitoring?

StackTether's tools are read-only. Management and Control would let anything holding the secret change devices or open remote sessions. See Read-only access first.