> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Jamf Pro OAuth 2.0 Client Credentials (Managed) connector profile – StackOne setup guide

> Set up the OAuth 2.0 Client Credentials (Managed) connector profile for Jamf Pro in StackOne. One-time admin setup required before your users can link Jamf Pro accounts via Hub.

<Warning>Requires Jamf Pro 10.49.0 or later. You must be a Jamf Pro administrator of the tenant.</Warning>

<section data-guide-section data-guide-scopes="">
  <h2>Create an API Role</h2>

  <p>An API Role groups one or more Jamf Pro privileges (e.g. "Read Computers", "Update Mobile Devices") that the API Client will be allowed to exercise. You can also reuse an existing role.</p>

  <Steps>
    <Step title="Sign in to your Jamf Pro web console">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Sign in as a Jamf Pro administrator at `https://<your-tenant>.jamfcloud.com` (Jamf Cloud) or your self-hosted Jamf Pro URL.</p>
      </div>
    </Step>

    <Step title="Navigate to API Roles">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Go to <strong>Settings > System > API Roles and Clients</strong> and click the <strong>API Roles</strong> tab.</p>
      </div>
    </Step>

    <Step title="Create the role">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Click <strong>+ New</strong>, enter a Display Name (e.g. `StackOne Integration`), then select the Jamf Pro privileges that StackOne should be allowed to use. Common privileges:</p>

        <ul>
          <li>Read Computers, Create Computers, Update Computers, Delete Computers</li>
          <li>Read Mobile Devices, Update Mobile Devices, Send Mobile Device Wipe Command</li>
          <li>Read Smart Computer Groups, Create Smart Computer Groups, Update Smart Computer Groups, Delete Smart Computer Groups</li>
          <li>Read Static Computer Groups, Create Static Computer Groups, Update Static Computer Groups, Delete Static Computer Groups</li>
          <li>Read Users, Create Users, Update Users, Delete Users</li>
          <li>Read Scripts, Create Scripts, Update Scripts, Delete Scripts</li>
          <li>Read Categories, Create Categories, Update Categories, Delete Categories</li>
          <li>Read Buildings, Create Buildings, Update Buildings, Delete Buildings</li>
          <li>Read Departments, Create Departments, Update Departments, Delete Departments</li>
          <li>Send Computer Remote Command, Send Mobile Device Remote Command</li>
          <li>Read Policies, Create Policies, Update Policies, Delete Policies</li>
          <li>Read macOS Configuration Profiles, Read Mobile Device Configuration Profiles</li>
        </ul>
      </div>
    </Step>

    <Step title="Save the role">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Click <strong>Save</strong>. The role is now available to be assigned to API Clients.</p>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Create an API Client</h2>

  <p>An API Client is the credential that StackOne will use to obtain access tokens.</p>

  <Steps>
    <Step title="Switch to API Clients tab">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>From <strong>Settings > System > API Roles and Clients</strong>, click the <strong>API Clients</strong> tab.</p>
      </div>
    </Step>

    <Step title="Create the client">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Click <strong>+ New</strong> and configure:</p>

        <ul>
          <li>Display Name: `StackOne` (or similar identifying name)</li>
          <li>API Roles: assign the role you created in the previous section</li>
          <li>Access Token Lifetime: number of seconds tokens should be valid for (default 1800 — 30 minutes — is recommended for security)</li>
          <li>Enabled: ON</li>
        </ul>
      </div>
    </Step>

    <Step title="Save and capture Client ID">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Click <strong>Save</strong>. The <strong>Client ID</strong> (a UUID) is shown — copy it.</p>
      </div>
    </Step>

    <Step title="Generate Client Secret">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Click <strong>Generate Client Secret</strong>. The secret is shown <strong>only once</strong> — copy it immediately and store it securely. If you lose it you must regenerate (and update StackOne).</p>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Enter credentials in the connector profile</h2>

  <p>Provide the tenant URL, Client ID, and Client Secret in the StackOne connector profile. End users will not be asked for credentials when linking an account.</p>

  <Steps>
    <Step title="Enter the Jamf Pro URL">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>The full base URL of your Jamf Pro instance — e.g. `https://acme.jamfcloud.com` (Jamf Cloud) or `https://jamf.example.com:8443` (self-hosted). No trailing slash.</p>
      </div>
    </Step>

    <Step title="Enter the Client ID">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Paste the <strong>Client ID</strong> from your API Client.</p>
      </div>
    </Step>

    <Step title="Enter the Client Secret">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Paste the <strong>Client Secret</strong>.</p>
      </div>
    </Step>
  </Steps>
</section>

## Creating the StackOne Connector Profile

To create the Connector Profile in StackOne for <strong>Jamf Pro</strong>:

<Steps>
  <Step title="Navigate to Connector Profiles">
    Login to StackOne and navigate to [Connector Profiles](https://app.stackone.com/connector_profiles)
  </Step>

  <Step title="Create New Connector Profile">
    <ul>
      <li>Click <strong>+ Connector Profile</strong></li>
      <li>Search for and select <strong>Jamf Pro</strong></li>
      <li>Select <strong>Type</strong> as <strong>OAuth 2.0 Client Credentials (Managed)</strong></li>

      <li>
        Fill out the fields using details retrieved from your provider:

        <ul style={{ marginLeft: '20px' }}>
          <li><strong>Jamf Pro URL</strong></li>
          <li><strong>Client ID</strong></li>
          <li><strong>Client Secret</strong></li>
        </ul>
      </li>

      <li>(Optional) Select <strong>Actions</strong> to be enabled for this Connector Profile</li>
      <li>Click <strong>Create profile</strong></li>
    </ul>
  </Step>
</Steps>

Congratulations! The new Connector Profile will now show up in your project ready to be used. You can now continue to <a href="/connect/managing-connectors/linking-accounts">Link Accounts</a> for <strong>Jamf Pro</strong>.