Connections & agent install

A connection is one paired Dynamics GP install. You pair it once by running a small agent on the GP server; after that, lb_live_ keys read and write that GP through it.

Pair a connection

1. In the dashboard, go to Connections → New connection and give it a name. You get a pairing code (valid 10 minutes) and a download link for the agent.

2. On the GP server (Windows), open PowerShell as Administrator and run the three commands the wizard shows you. The installer verifies the agent's published SHA-256 before installing it.

   # the dashboard fills in your exact code
   irm https://erpspan.com/install.ps1 | iex
   erpspan-agent pair 7K2M-9DQ4
   erpspan-agent configure-sql

   configure-sql securely prompts for a read-only SQL login and, optionally, a separate eConnect/write login. Use SQL authentication rather than Windows Integrated Security because the service runs as LocalSystem. The successful final command starts the service.

3. The connection flips to Connected and lists the GP companies it found. Pick a default company for calls that omit X-Company.

The current binary is unsigned, so Windows may show an Unknown Publisher warning if it is launched directly. The installer still refuses to install it unless its SHA-256 exactly matches the release configured by ERPSpan.

Security model

The agent is designed to run inside a hostile network with no inbound exposure:

• Outbound-only over WSS 443. The agent dials out to the cloud and holds one encrypted WebSocket. No inbound ports are opened, no VPN, no port-forwarding.
• Read-only SQL login. Reads run under a SQL login granted SELECT only; the agent additionally rejects any non-SELECT statement. A ready-to-run script to create that login is provided during onboarding. Reads can never mutate GP.
• Writes only through eConnect. Every write goes through GP's eConnect stored procedures inside a transaction — never raw SQL — so GP's own validation runs and a bad document rolls back.
• Credentials stay on-prem. The SQL credentials live only inside the agent, DPAPI-encrypted at rest. They are never sent to the cloud. API keys and agent tokens are stored server-side as SHA-256 hashes only.

Write access

Writes are off by default for every object on every connection. Enable an object under Connections → (your connection) → Write access; each toggle confirms that writes create unposted GP batches. See Writes & batches.

Companies

A connection exposes every GP company database the agent can see. Target one per request with X-Company: <INTERID>, or rely on the connection's default company.