From be60a04556305bc0b91d74310adb45c1c30ff83b Mon Sep 17 00:00:00 2001 From: mlsmaycon Date: Mon, 24 Aug 2026 07:47:31 +0000 Subject: [PATCH] [agent-network] Document the provider save-time check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Saving a provider now asks the vendor whether its url and credential work, and refuses the record if they do not. That changes what the Connect a Provider steps promise, so step 6 says so and a new subsection covers the rest: which of the two fields a refusal names, that an edit is only re-checked when the url or the key moves, that a url-only change is tested against the stored credential, and that a rejected key never replaces a working one. The list of what is not checked is the part worth getting right — an operator whose provider saved without a word should be able to see why. It covers the providers that publish no listing, a Bedrock record pointed somewhere AWS does not own, and any upstream on a private address, which the agents reach through the tunnel and the management service cannot reach at all. --- src/pages/agent-network/providers.mdx | 46 ++++++++++++++++++++++++++- 1 file changed, 45 insertions(+), 1 deletion(-) diff --git a/src/pages/agent-network/providers.mdx b/src/pages/agent-network/providers.mdx index e8c3a685..9a2e573a 100644 --- a/src/pages/agent-network/providers.mdx +++ b/src/pages/agent-network/providers.mdx @@ -59,12 +59,56 @@ and budgets (see [How It Works](/agent-network/how-it-works#llm-apis-and-ai-gate the vendor's own list — see [Load Models from the Provider](#load-models-from-the-provider). 5. _(Optional, gateways)_ Fill any gateway-specific fields (for example a Portkey config ID) and the identity headers used for attribution. -6. Save the provider. +6. Save the provider. NetBird checks the upstream URL and the credential against the + vendor before storing them — see [The Save-Time Check](#the-save-time-check).

agent network connect provider modal

+### The Save-Time Check + +Before storing a provider, NetBird asks the vendor whether the upstream URL and the +credential work, using the same model listing that +[Load models from provider](#load-models-from-the-provider) uses. A record that cannot reach +its vendor is refused at the form, rather than saving cleanly and surfacing later as a +refused request or an empty model list with nothing tying it back to the record. + +If the vendor refuses, the provider is not saved. The form stays open with what you typed +still in it, and the message names which of the two is at fault: the credential was +rejected, or the upstream URL could not be reached or does not answer a model listing. Fix +the field it names and save again. + +On an existing provider, the check runs only when you change the **Upstream URL** or the +**API key** — renaming a provider, editing model rows or changing prices saves without +asking the vendor anything. Two consequences worth knowing: + +- **Changing only the URL tests it against the stored credential.** The key never returns to + your browser, so there is nothing else it could be tested with. +- **A rejected key never replaces a working one.** If you paste a new key and the vendor + refuses it, the provider keeps running on the old one. + +**Which providers are checked.** The same four that can list their models: **OpenAI**, +**Anthropic**, **Amazon Bedrock** and **Google Vertex AI**. Everything else saves without a +check, because there is no listing to ask for or no way to reach it: + +- Azure OpenAI, Mistral, Kimi, the AI gateways and custom endpoints, which publish no + listing NetBird can ask for. +- A Bedrock provider pointed at a proxy or a self-hosted endpoint rather than an AWS runtime + host, because the control plane that serves the listing is derived from that URL and + cannot be worked out from an address AWS does not own. +- Any upstream on a private address. Your agents reach it through the tunnel, but NetBird's + management service has no route to it, so there is nothing it can ask. + +An unchecked provider is not a lesser one; NetBird simply has no way to verify it up front, +so it saves what you entered. + + +A vendor outage also fails the save — the check cannot confirm the provider either way, and +saving something unverified is what it exists to prevent. If the message says the provider +returned an error rather than naming your URL or credential, wait and save again. + + ## Custom & Self-hosted Providers Pick **Custom / Self-hosted** for any OpenAI-compatible endpoint that isn't a first-party