Distribution
Sherweb integration
Reads your client list and each client's active subscriptions — what they already buy through you. Read-only.
Setup steps are for connected customers — sign in to read them.
What we find in Sherweb
Every active subscription the MSP resells per client, classified and fed into the same agreement_gap signal as Pax8. Response field names are a best-guess convention, not confirmed against Sherweb's own docs — a wrong guess fails loudly (zero lines produced) rather than fabricating a claim.
Every finding lands on your Client Upsell board as a named client with a number beside it — not a report you have to read.
What the Sherweb connection does
Read — powers Client Upsell
Read your clients' stack
What each client already buys through you — the gap a PSA agreement alone can't see.
Read-only, and checked
A write-capable credential is refused, not warned about
We test the key you give us the moment you submit it. If it can write to Sherweb, we reject it and tell you which step to change — there is no override. It is encrypted at rest, held in one vault in one application, and nothing is ever written back to Sherweb.
Sherweb integration — common questions
- What does the Sherweb integration read?
- Reads your client list and each client's active subscriptions — what they already buy through you. Read-only.
- What does MSProspector find in Sherweb?
- Every active subscription the MSP resells per client, classified and fed into the same agreement_gap signal as Pax8. Response field names are a best-guess convention, not confirmed against Sherweb's own docs — a wrong guess fails loudly (zero lines produced) rather than fabricating a claim.
- Is the Sherweb connection read-only?
- Yes. The credential is checked live when you submit it and a write-capable one is refused, with no override — and every connector we ship is checked, at every commit, by an automated build rule that fails if it contains anything other than a GET call. The credential itself is wrapped by a key that lives in Azure Key Vault's hardware security module and never leaves it — our application can ask the vault to wrap or unwrap it, but cannot read the wrapping key. See our security page for the full picture.