IT Glue: documents, passwords and renewals where your team works

Connect IT Glue and your team opens a partner's documents and passwords from the ticket they are working and from the company page, and sees renewals coming due before something lapses. A password is fetched from IT Glue only when someone presses Reveal, shows for 30 seconds, and is never stored in Current.

IT Glue is where an MSP writes down how each partner's environment works: the documents, the passwords, the device configurations and the dates things run out. Documents and the list of passwords are read from IT Glue when someone opens them.

IT Glue's API comes with its Enterprise plan, and only a user with IT Glue's Administrator role can create a key. One key reaches every organization in your IT Glue account. IT Glue has no read-only key, so Current's own rules decide what the key is used for: every request is checked against a short list of IT Glue addresses before it is sent.

1. 1
   1 · Sign in to IT Glue as an Administrator

   Open Admin, then Settings, then API Keys. Some accounts label the tab Custom API Keys.
2. 2
   2 · Create the key and name it Current

   Choose Create API Key and give it a name a colleague will recognise, such as Current, so a future admin can tell which key belongs to what.
3. 3
   3 · Decide on Password Access

   Password Access is a setting on each key, and IT Glue returns password values through its API only when it is on. Turn it on if your team should be able to reveal passwords in Current. Leave it off and everything else still works (documents, the names of passwords and renewals), and Reveal tells the person that the key can't read passwords.
4. 4
   4 · Copy the key now

   IT Glue shows the key once, when you generate it, and never again. If the page closes before you copy it, revoke that key and create another.

1. 1
   Open the IT Glue card

   In Current, open Settings › Integrations (Tenant Admins only) and pick IT Glue in the Documentation group to open its card.
2. 2
   Paste the key, then pick your region and web address

   Choose the region your IT Glue account lives in: US, EU or Australia. A key sent to the wrong region is refused, so the region is the first thing to check when a key is rejected. The web address is the one you sign in to IT Glue at, such as https://yourcompany.itglue.com (EU accounts end in .eu.itglue.com and Australian ones in .au.itglue.com). Current builds every Open in IT Glue link on that address, and accepts only an https address on itglue.com.
3. 3
   Press Test connection

   Current reads one page of your IT Glue organizations to prove the key works, and counts them. It never reads a password to test a key. On success the key is stored server-side only: the browser never sees it again, and it is never written into a web address, a status message or a log.

Each IT Glue organization is one partner. Every sync reads your organizations and links each one to a Current company. When IT Glue's API returns the PSA link it keeps on an organization (IT Glue keeps one when it syncs organizations from Autotask or ConnectWise PSA), Current tries that PSA company ID first and links the one company that carries it. Otherwise it links the Current company with the same normalized name (lowercased, with punctuation and Inc/LLC/Ltd-style suffixes stripped) when exactly one company matches. When two or more of your companies share that name, Current links the one that is an active customer, or, if none of them is, the one linked to your PSA. Anything still tied waits for you on the Unmapped tab rather than being paired on a guess.

1. 1
   Let the automatic pass run first

   The clear matches link themselves on the first sync, and only the ambiguous ones need a hand. Press Sync now on the card to run the first sync straight away instead of waiting for the daily one.
2. 2
   Open the mapping panel

   Settings › Integrations → IT Glue → Manage → Customer mapping. It opens on the Unmapped tab, which lists every IT Glue organization the automatic pass could not place.
3. 3
   Map an organization to its company

   On an unmapped row press Map, type a few letters of the company, and pick it. That organization's renewals attach right away, and its documents and passwords show on the company the next time someone opens them.
4. 4
   Ignore internal or test organizations

   For an organization that should never map to a partner (your own internal documentation, a lab, a template) press Ignore. It moves to the Ignored tab and stops counting as unmapped.
5. 5
   Fix a wrong match later

   The Mapped tab lists every link; Unmap corrects a bad automatic match, and Un-ignore brings a dismissed organization back. A mapping you set by hand is never overwritten by a later automatic match.

Docs and passwords shows on the company record, as a panel on a service desk ticket, and on the Overview of a PSA ticket opened in the drawer. On a ticket it shows the ticket's company. On a PSA ticket it stays folded until you open it, and nothing is read from IT Glue until then. The company's renewals are described under Renewals below.

The Documents group lists the documents in every folder, most recently updated first, with a search box once there are more than eight. Clicking one opens it in a reader beside the panel: headings, text and numbered steps show, and images stay in IT Glue, with a line in the reader saying so. The reader is a protected frame: nothing written into a document can run inside Current, and it cannot load anything from anywhere else. A link inside a document opens in a new browser tab. The Passwords group lists each password by name, username and category, except a restricted one, which shows its name only. Opening the list never reveals anything, and archived passwords are left out of it. If IT Glue answers the passwords but not the documents, the Documents group says the documents couldn't load and the passwords show as usual; try again in a minute.

Press Reveal on a password row. Current asks IT Glue for that one password at that moment, runs the checks below, records the reveal, and only then shows it, under the row:

• The username, with a Copy button.
• The password, masked until you press Show, with its own Copy button. A password that is empty in IT Glue reads Empty in IT Glue, with nothing to show or copy.
• The one-time code with a countdown, when the login has one and IT Glue provides it (see One-time codes below).
• Open in IT Glue.
• A line saying the reveal was recorded.
• A thin bar that runs down over 30 seconds.

When the bar runs out, the password, the username and the code are cleared from the screen. They are also cleared when you press Hide, when the panel closes, and when the browser tab is hidden, for example when you switch to another tab. To see the password again, press Reveal again. That is a new reveal, and it is recorded too.

Engineers, dispatchers, vCIOs, project managers, service managers and tenant admins. The rule names the roles that are allowed, so a role added to Current later is refused until someone decides otherwise. Account executives and sales managers can't open documents or reveal passwords, and Partner Viewers never see any of it. The company has to be in your own workspace, and the password has to belong to the IT Glue organization matched to that company: a password from any other organization is refused, even when someone sends its ID directly. Every one of these checks runs on Current's server for every request, not only in what the screen shows.

Each person can reveal 20 passwords in any 10 minutes and 200 in a day, and a workspace can reveal 1,000 in a day. Past a person's limit, Reveal says reveals are paused for you and to try again later or ask an admin, and nothing is shown. Once the workspace reaches its 1,000 for the day, Reveal says so and that reveals resume tomorrow. The first time someone in the workspace is paused on a given day, its tenant admins are notified. The limits count reveal attempts, including refused and paused ones; reading documents and the password list doesn't count toward them.

During a Current support session, when someone from Current support is signed in to your workspace to help, passwords can't be revealed, and Reveal says so.

IT Glue lets you restrict a password to named people or groups. The API key sees every password in the account, restricted ones included, so Current cannot tell whether you are one of the people allowed. It never reveals a restricted password, and it shows no more of one than its name: the row reads Restricted in IT Glue and offers Open in IT Glue, where IT Glue's own permissions decide, with no username or web address beside it. Current checks the password as IT Glue returns it at the moment of the reveal, not the list the page loaded earlier, so a password restricted a minute ago is already refused. An archived password is not revealed either.

IT Glue can hold a one-time code for a login, and its API documents the secret behind the code as something you can write but not read back. So Current shows a code only when IT Glue provides one. When IT Glue returns the secret with the password, Current works out the current six-digit code, shows it with the seconds it has left, and discards the secret; neither the code nor the secret is stored. When IT Glue doesn't return it, the reveal says the login also needs a one-time code and that you can see the code by opening the password in IT Glue.

Every reveal is recorded before the value leaves Current's server. If the record cannot be written, the reveal stops and nothing is shown. The record holds who revealed the password, its name, the company, where it happened (a service desk ticket, a PSA ticket or the company page), when, whether a one-time code was shown, and the result. It never holds the value. A reveal Current refused or paused is recorded too, so the list also shows attempts that showed nothing: a restricted or archived password, one from another organization, a key without Password Access, a password IT Glue couldn't find, a support session, or a person past the reveal limits (listed at most once every 5 minutes while the pause lasts).

IT Glue records a password read through its API against the API key, not against a person, so its own logs show Current's key and nobody behind it. IT Glue's Password Access workflow can notify you each time a password is read through the API, and that notification names the key too. Current's list is therefore the record of who looked. Tenant admins find it in Settings under Password reveals once IT Glue has been connected, and it stays there after IT Glue is disconnected: when, who (Former member for someone no longer in the workspace), the company, the password, where, the result (Shown, a Refused line naming why, Paused: too many reveals, Failed, or Not finished) and whether a code was shown, with a CSV export. Records are kept for 365 days.

No password value, username, one-time code or note ever reaches an AI model. Ask Current can list the names of a company's IT Glue passwords for people who can open IT Glue, so someone can ask which logins are documented, and it never sees more than the name. A document's text reaches a model only when a person asks Ask Current a question on a service desk ticket, and then only the documents of that ticket's company.

Once a day Current reads the renewal dates IT Glue tracks for each matched organization, from 30 days ago to 120 days ahead: SSL certificates, domains, warranties, licences and any date on a flexible asset that IT Glue tracks as an expiration. They show on the company record under Expiring soon, each with the item, its type and the date in words ("in 12 days", "expired 3 days ago"), dates already past in red and dates coming up soon in amber, and Open in IT Glue on every row. On the CRM company record a line counts the renewals due. A company with nothing in the window shows no list at all, and while IT Glue is disconnected the list and the count are hidden.

The company alert band carries a Documented renewals are due entry: a warning when something expires within the next 30 days, and critical when something expired in the last 30 days. It lists up to three of the items with their type and date.

An expiry date is not a secret, so renewals reach more people than documents do: engineers, project managers, tenant admins and sales leadership see them, and an account executive sees them on any company they can view. Partner Viewers never do. An item IT Glue stops returning drops off after a complete read without it.