BillRecon
Menu
Browse docs

Connect HaloPSA

Read your HaloPSA recurring-invoice lines as the billed side of reconciliation, using a dedicated least-privilege API key. Read-only by default.

HaloPSA is a PSA connector: it's the billed side, what you actually charge. BillRecon reads your recurring-invoice lines and lines them up against what each client has. It's a read-only mirror. BillRecon never authors contracts, and HaloPSA stays your system of record.

Create a least-privilege API key

In HaloPSA, an integration's access is capped by the agent and role you bind it to. So instead of using an admin login, create a dedicated, restricted agent for BillRecon. That agent's role is what keeps the access minimal.

  1. Create a restricted role. Go to Configuration, then Teams and Agents, then Roles, and add a new role. Do not make it an administrator. For reconciliation (read-only), give it view access to Clients and to Invoicing/billing, and no edit permissions.
  2. Create an API-only agent. Go to Configuration, then Teams and Agents, then Agents, and add a new agent with the role above. Mark it as an API-only agent so it can't be used to log in interactively and doesn't take a normal seat.
  3. Create the API application. Go to Configuration, then Integrations, then Halo API, then View Applications, then New. Set the authentication method to Client ID and Secret (Services), and set it to log in as the agent you just created. Copy the Client ID and Client Secret (the secret is shown only once).

Read-only now, write-back later

The role above is read-only, which is all reconciliation needs. If you later turn on write-back, add the billing edit permission to that same role. Leaving it off keeps BillRecon read-only no matter what.

Connect in BillRecon

Open Connections, choose HaloPSA, and enter:

  • your HaloPSA host (for example yourmsp.halopsa.com),
  • the Client ID,
  • the Client Secret.

BillRecon runs a single test read to confirm the credentials before saving. Your host has to be publicly reachable: a private or internal-only address is rejected.

What it reads

BillRecon reads your clients and your recurring-invoice lines: the product, the quantity, and the price on each line. Those become the billed side of every comparison, matching what you see in the HaloPSA console.

If a read is refused

If BillRecon can't read your recurring invoices, the role is usually missing the billing view permission. Grant that specific permission on the role rather than making the agent a full administrator. The exact permission labels move around a little between HaloPSA versions, so match the narrowest "view invoices / billing" option your version offers.

Next: walk the reconciliation workflow. Back to all connectors.