Connector Installation Step by Step

This guide walks you through every screen of the Documents Partner API Connector installation on a Windows server. It is designed to be read alongside the process as you sit at the machine.

The screenshots were taken on a German-language Windows 11 computer.

All values shown in the screenshots that look like placeholders are placeholders. Not a single real customer value is shown. In the two enrollment consoles, the real hostname has been replaced with <tenant>.stp-cloud.de. Wherever a redacted value matters, the surrounding text explains what belongs there.

Before You Begin

Have the following information ready. The wizard requires the first item and offers the other two as optional inputs:

System Requirements

On the minimum version of the document management system. The required version is v8.8.16 (Build 8.8.195.16) – the version currently available in the STP Download Portal.

This requirement is stated to the exact build number rather than rounded to "8.8 or later": within the 8.8 series, components of the server infrastructure were updated several times, and an older build within the same series cannot be guaranteed to be compatible. On such a build, calls may fail without producing any meaningful error message.

If you are unsure which version is running in your environment, clarify this with STP Support before installing the connector.

1. Install the Prerequisite: .NET Runtime 10 (x64)

The connector is shipped without an embedded runtime. The .NET runtime is therefore not part of the installation package and must already be present on the machine.

Download page: https://dotnet.microsoft.com/download/dotnet/10.0

Two runtimes are required, and the ASP.NET Core Runtime installer does not include the .NET Runtime. There are therefore two options:

Run both installers as an administrator and accept the defaults. Then verify:

dotnet --list-runtimes

Both lines must appear with a 10.* version:

Microsoft.AspNetCore.App 10.0.x [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App    10.0.x [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]

What It Looks Like When They Are Missing

If the installation package is launched without the runtimes present, it aborts immediately at the start – it refuses to install rather than setting up a service that would never be able to start:

"Microsoft .NET Runtime 10 (x64) including ASP.NET Core Runtime is not installed on this computer. Please install it from https://dotnet.microsoft.com/download/dotnet/10.0 and then restart the setup."

This is backed by a check that looks under C:\Program Files\dotnet\shared\ for a 10.* folder for both runtimes. A machine with only .NET 9, or with only one of the two, is caught here rather than three minutes later in the event log. Install the runtimes and relaunch the installation package.

Unattended installations hit the same check and exit with a non-zero return code.

2. Welcome Screen

Launch Documents Partner API Connector by SEPTEO <version>.msi as an administrator.

There is nothing to decide here – click "Next >".

There is no license page and no page for user or company information: a service installer for the entire machine requires neither.

3. Setup Type

Leave "Complete" selected and click "Next >".

"Custom" exists only to change the installation directory. The product consists of a single component, so there is nothing to deselect. That path is also the quickest way to view the target directory without changing anything:

C:\Program Files\SEPTEO\Documents Partner API Connector\

The component tree contains exactly one entry – Documents Partner API Connector by SEPTEO, approximately 11 MB. This is why "Complete" and "Custom" install the same thing. "Change…" moves the directory; everything else on this page is purely informational.

4. Connection Configuration

This is the one value the connector truly needs: the tenant.

Enter the tenant name in "Tenant" – the first part of the STP Cloud login address (https://<tenant>.stp-cloud.de) from the firm's access credentials. (The field is redacted in the screenshot; a real entry looks like kanzlei-mustermann.)

What this does: the tenant becomes the connector's addressing target and determines the two login endpoints it authenticates against. The cloud environment itself is preset to the STP production environment – the page deliberately asks for nothing more.

The field may be left blank. The service will then be installed but not configured, and will wait until the tenant is added later. During an update, the previously saved tenant is already filled in – it is stored outside the installation directory and read back in at the start of each run.

5. DMS Connection (Optional)

The credentials the connector uses to connect to the local LEXolution.DMS.

The wizard masks both password fields automatically. The other values in the screenshot are examples – your actual values will be provided by your DMS administrator.

It is all or nothing, and that is by design:

• All four fields filled in → An active Dms configuration is written, and the connector communicates with the real DMS.
• Any field left blank → An inactive template is written instead, containing the non-secret values entered (host, usernames) so nobody has to retype them. Passwords are never written to the template. The connector then starts normally but serves pre-built test data until the template is completed and activated. STP Support handles that step.
• An existing Dms configuration is never overwritten – neither by a fresh installation nor by an update, regardless of what is entered here.

Where these passwords are stored. In plain text in the connector's configuration file under %ProgramData%\SEPTEO\Documents Partner API Connector, with access restricted to SYSTEM and Administrators. They are masked in the installation log and are never written to the registry – however, a local administrator can see them in the process command line during installation. If that is not acceptable for the firm, leave these five fields blank and supply the credentials afterwards as Dms__* environment variables on the service. That is the only approach that keeps no secrets on disk.

Continue with "Next >".

6. Proxy (Optional)

This page determines how the connector reaches the internet. Its subtitle states the rule: "Only fill in if this computer reaches the STP Cloud exclusively through a proxy." On a machine with direct outbound access on port 443, this page is skipped entirely – leave everything blank and click "Next >".

The four fields in the order they appear:

A blank address changes nothing. This is not an error or a restricted mode: Windows proxy settings and the HTTP_PROXY / HTTPS_PROXY environment variables continue to apply unchanged. The other three fields are then irrelevant. This page is only filled in when the machine cannot reach the cloud without a proxy, or when the proxy requires authentication.

⚠️ "Exceptions" are regular expressions, not wildcards. This is the one field on this page that reliably causes confusion – *.company.local is not what you want. The correct form is dms\.intern\.local, or .*\.company\.local for an entire domain; multiple entries are separated by semicolons. An invalid expression causes the service to fail to start with a readable message, rather than silently ignoring the entry.

What goes through the proxy. Everything the connector opens toward the cloud: the connection to the message broker, authentication and device enrollment calls, retrieval of the cloud key, and document transfers. The connection to the local DMS is not affected: it runs within the firm's network and never goes through a proxy.

"STP Cloud" is more than one destination. Only the authentication and cloud-key calls go to https://<tenant>.stp-cloud.de. The message broker is AWS IoT Core (….iot.eu-central-1.amazonaws.com), and document bytes travel over signed S3 URLs – both are reached directly at AWS, outside the stp-cloud.de domain. A proxy or firewall allowlist that permits only *.stp-cloud.de will therefore block the connection to the broker and every document transfer; amazonaws.com addresses must also be allowed.

The service runs as LocalSystem – browser proxy settings do not apply to it. The note on the page states this explicitly: "the service runs as LocalSystem and does not see the user-specific proxy settings of the browser." "It works in Edge" therefore says nothing about whether the connector can reach the outside. Where a proxy is configured per user rather than machine-wide, this page is the only way to make it available to the service.

Where the proxy password is stored. Exactly like the DMS passwords from Step 5: in plain text in the machine configuration under %ProgramData%\SEPTEO\Documents Partner API Connector, restricted to SYSTEM and Administrators, masked in the installation log – and never in the registry. Only the address, username, and exclusion list are stored there so the wizard appears pre-filled during an update. Because the password is not included, an update shows an empty password field, and the installer retains the existing password rather than clearing a working proxy. If storing no secrets on disk is a requirement here as well, leave "Proxy password" blank and set Proxy__Password afterwards as an environment variable on the service.

Continue with "Next >". Beyond these four fields, there are additional proxy settings – integrated authentication with the computer account, an NTLM domain, the rule for local addresses – that the wizard does not ask for; they are passed as installation parameters or entered manually in the machine configuration.

7. Installation

The confirmation page "Ready to Install the Program" is the last point at which "< Back" can still make changes:

Clicking "Install" starts the copy process – the shield icon on the button indicates that Windows will prompt for elevated privileges. The wizard then carries out the installation:

The status bar shows the current step; "Registering product" and "Starting services" are the two critical ones, as this is where the Windows service is created and started. What happens during this phase:

1. The program files are placed in C:\Program Files\SEPTEO\Documents Partner API Connector.
2. The DocumentsPartnerApiConnector service is registered – display name Documents Partner API Connector by SEPTEO, account LocalSystem, startup type automatic – and started.
3. The values from Steps 4 through 6 are written to %ProgramData%\SEPTEO\Documents Partner API Connector\appsettings.json, outside the installation directory so they survive every future update. The non-secret values are additionally stored under HKLM\SOFTWARE\SEPTEO\Documents Partner API Connector, which pre-fills the wizard during a later update – passwords are never stored there.
4. Two shortcuts named "Enroll Documents Partner API Connector" are created, one in the Start menu and one on the desktop.

Steps 2 and 3 occur in this order – the configuration is written before the service starts, so the service knows its tenant from the very beginning.

Click "Finish" to close. This page only confirms that the installation was successful – it says nothing about whether the service can actually reach the cloud. That is what the next two steps are for.

8. Verify the Service

The connector is a Windows service and should be running immediately after installation:

The service has two names, and it is worth knowing both – services.msc shows one, while PowerShell and the registry use the other:

The entry must show the service as Running, startup type as Automatic, and account as LocalSystem – as shown in the screenshot. From PowerShell using the technical service name:

Get-Service DocumentsPartnerApiConnector | Format-List Name, DisplayName, Status, StartType

The description is not included in this output – it comes from WMI:

(Get-CimInstance Win32_Service -Filter "Name='DocumentsPartnerApiConnector'").Description

Don't confuse it with its neighbor. Where the STP Documents On-Premise Agent for STP.Documents is installed, it appears in the same list. That is a separate, independent STP service. Both intentionally coexist and neither replaces the other. Ours is the one whose display name ends with by SEPTEO and whose description mentions the Documents Partner API; its service name is DocumentsPartnerApiConnector.

The installation also appears under "Apps & Features" – the quickest way to check the version on a managed machine:

Version and publisher are the two relevant fields. The publisher shown is STP Informationstechnologie GmbH – the legal entity, even though the product name carries by SEPTEO.

If the service does not stay running, the most common cause is a blank Step 4 – no tenant configured, so nothing to connect to. This is a configuration gap, not a broken installation. The second most common cause is an active DMS configuration pointing to an unreachable DMS; this deliberately aborts startup. STP Support can help in both cases.

9. Enrollment – Enrolling the Connector Once

One step remains: the connector must authenticate against the STP Cloud once to receive its own permanent identity. The installer has created a shortcut for this on the desktop and in the Start menu:

⚠️ Enrollment requires administrator rights – it will request them automatically

A double-click on the shortcut is all that is needed. The script checks whether it has elevated privileges and, if not, relaunches itself via UAC. Windows will therefore display a confirmation prompt – this must be accepted.

If it is declined, the window displays "Administrator rights are required – the elevation prompt was declined.", remains open, and exits with return code 740.

Why the rights are needed: Enrollment writes the connector's identity to %ProgramData%\SEPTEO\Documents Partner API Connector – a directory whose access rights permit only SYSTEM and Administrators.

Anyone starting enrollment from a command prompt should use an elevated one from the outset – this avoids the UAC prompt entirely.

9a. The Console Displays a Code and Opens the Browser

The console displays the user code along with the corresponding URL and then waits:

To enroll this connector, approve code 316269830 at:
  https://<mandant>.stp-cloud.de/identity/device?userCode=316269830
Waiting for approval...

The domain in this URL is the one this machine is configured for – it may not always be stp-cloud.de. If it looks unfamiliar, compare it with the entry from the "Connection Configuration" step.

The browser opens automatically on the login page:

"Sign in with your stp.one account" asks for an email address and password. Sign in here using the firm's connector login account – a user account on the tenant with the DmsCloudApi.Connector role. A standard user account is not sufficient.

Not to be confused with a partner application account. The connector login account is used solely to enroll this installation once; it does not itself access any case files. The accounts used later to read and write documents carry the DmsCloudApi.User or DmsCloudApi.User.Reader roles and are independent of this.

The role is assigned by the firm's administrator in STP Cloud user management – via the standard group Documents Partner API Connector, which already exists in every tenant. If the role is missing, enrollment fails at the consent page.

9b. Confirm the Permissions

The consent page names the application – Documents Partner API - On-Premise Connector – and requests two permissions.

⚠️ Leave both permissions checked. The page invites you to "deselect permissions you do not wish to grant" – do not do this. Without Offline Access, no refresh token is issued and enrollment fails with exactly that reason; without the access scope, the connector cannot reach the broker.

Confirm by clicking "Yes, allow".

If you accidentally click "No, deny", the browser shows:

The console receives no notification of the denial. It stays at "Waiting for approval…" until its code expires – which feels like a hang rather than a rejection. Close the console, relaunch the shortcut, and approve the new code. The old one is dead; reopening the URL from the first attempt simply repeats the denial.

9c. Confirm Both Windows

The browser confirms the device is authorized and can be closed:

And the console, which has been waiting in the background, completes on its own:

info: STP.Dms.Core.Authentication.Stp.DeviceFlowEnrollment[0]
      Device-flow enrollment approved for client dms.cloud.api.connector
Enrollment complete. The connector can now start without re-authenticating.

Enrollment succeeded.

"Enrollment succeeded." is the key line – the window waits for a keypress so it cannot disappear before you have read it. A failure reports "Enrollment FAILED with exit code …" in the same place.

This can also be verified independently: on success, a refresh.dat file is present in %ProgramData%\SEPTEO\Documents Partner API Connector. The presence of this file is the quickest external confirmation that a machine is enrolled.

Test-Path "$env:ProgramData\SEPTEO\Documents Partner API Connector\refresh.dat"

The service also enrolls itself in the background as soon as a tenant is configured. The shortcut is therefore a convenience, not a hard requirement – it simply delivers the result immediately rather than requiring you to check the event log.

10. Done – Final Verification

Neither a running service nor "Enrollment succeeded." alone proves that the cloud can now see the firm. Only these three points together do:

Point 3 is the actual proof, and it cannot be verified on the firm's machine – it is answered by the cloud. A quick check with STP Support or a call from the partner application that will use the connector is sufficient: if the status query returns "connected": true, the installation is complete.

If it returns false while points 1 and 2 are both correct, the most common cause is a firewall or proxy blocking the AWS addresses – see Step 6.

What May Still Need Attention

• DMS credentials not entered in Step 5? The connector serves pre-built test data. STP Support activates the real DMS connection afterwards.
• Behind a proxy and Step 6 left blank? The connector can only reach the cloud if the machine's proxy settings already cover the LocalSystem account.
• Something not working as described? STP Support has a dedicated guide for ongoing operations – contact them with the tenant name and the time of the issue.
• Questions about the document management system itself? That is outside the scope of this guide – refer to the product documentation: STP Documents – General.

Common Installation Issues

For anything beyond the installation itself, STP Support is the right contact.

Symptom	Cause and resolution
Setup aborts with this dialog	One or both .NET 10 runtimes are missing. Complete Step 1 – the ASP.NET Core Runtime installer alone is not sufficient; the .NET Runtime is a separate download (or use the Hosting Bundle). Verify with dotnet --list-runtimes.
dotnet --list-runtimes shows 10.*, but setup still aborts	Wrong architecture – the connector is x64 and the check looks under C:\Program Files\dotnet\shared. An x86 runtime under C:\Program Files (x86)\dotnet does not count.
The tenant field is blank during an update	The saved value could not be read. Enter it again; it will be saved again at the end of the run.
The service is installed but stops immediately	Most likely no tenant was configured (Step 4 left blank). Add the tenant and restart the service.
Documents look like test data	The connector is running with its built-in sample data because no active Dms configuration exists – complete the template from Step 5.
The enrollment shortcut reports "endpoints not configured" (exit code 2)	No tenant was configured in Step 4, so there are no login endpoints. Configure the tenant, then relaunch the shortcut elevated.
The enrollment console reports "Administrator rights are required" and exits with 740	The UAC prompt was declined. Relaunch the shortcut and accept the prompt.
The browser showed "You have authorized the device" but the console reports an error	The confirmation succeeded but saving the token did not. Check whether the UAC prompt was accepted, and relaunch the shortcut – the browser confirmation can be granted again.
Enrollment complains about a missing refresh token	Offline Access was unchecked on the consent page. Go through the process again and leave both permissions checked.
The code in the console expired before anyone confirmed it	Device codes are short-lived. Simply relaunch the shortcut – a new code is issued each time.
Nothing reaches the cloud at all and the machine is behind a proxy	The service runs as LocalSystem and does not see a browser's user-specific proxy settings. Configure the proxy explicitly – Step 6. The log line Outbound proxy: … at each startup shows which proxy is in effect.
The proxy is configured and now the service no longer starts	Read the message in the event log: an address without http://, a username without a password, or an invalid regular expression in "Exceptions" will deliberately prevent startup rather than applying the proxy partially. Exceptions are regular expressions, not wildcards.
The proxy responds with 407	It requires authentication – enter "Proxy username" and "Proxy password" in Step 6.

Further Reading

• Overview of the Documents Partner API – what the connector is for and what runs through it.