netbird-docs/src/pages/agent-network/connect-agents.mdx

import { Note } from '@/components/mdx'

export const description =
  'Point a local AI tool at NetBird Agent Network from the Connect Agent page: the keyless endpoint, ready-made configuration for Claude Code, Codex, the OpenAI SDK and cURL, and the providers and models your own policies allow.'

# Connect Agents

**Connect Agent** is the self-service page each user configures their own tools from. It
carries the account's [keyless endpoint](/agent-network/providers#the-keyless-endpoint), a
ready-made configuration snippet for common agent tools, and the providers and models the
user's own policies allow.

Unlike the rest of Agent Network, the page needs no administrative permission. Every
authenticated account member sees it, and the answer behind it is computed from the caller's
own group memberships, so two users on the same account can see different providers.

<p>
    <img src="/docs-static/img/agent-network/connect-agent/agent-network-connect-agent.png" alt="Connect Agent page with the API base URL, the Claude Code configuration snippet, and the caller's providers and models" className="imagewrapper-big" />
</p>

## API Base URL

The endpoint is the account's Agent Network base URL, shared by every connected provider
and reachable only over the NetBird overlay.

Agents send ordinary LLM requests to it with no provider API key. NetBird
authenticates the caller through your identity provider, authorizes the request against
your [policies](/agent-network/policies), and injects the upstream provider key
server-side.

## Configure Your Tool

Pick the tab that matches your tool. Each snippet is pre-filled with your endpoint, so it
can be copied and applied as it is:

- **Claude Code** — writes `ANTHROPIC_BASE_URL` into `~/.claude/settings.json`, together
  with an `apiKeyHelper` that satisfies the client's key check without a real key. Use the
  **Shell** link above the snippet to switch to the equivalent `export` lines, and **JSON**
  to switch back.
- **Codex** — a provider block for `~/.codex/config.toml`.
- **OpenAI SDK** — a Python client pointed at the endpoint's `/v1` path, with a placeholder
  `api_key` the client requires but NetBird ignores.
- **cURL** — a complete request, handy for a first smoke test.

The dropdown above the Claude Code snippet selects which backend the configuration targets:
**Anthropic API**, **Vertex AI**, or **Bedrock**. Claude Code reaches Vertex AI and Bedrock
through their own base URL variables, so the snippet changes accordingly.

<Note>
A **Kimi CLI** tab and a **Kimi (Moonshot AI)** entry in the Claude Code dropdown appear
only when a Kimi provider is reachable for you, since that configuration works only against
an endpoint that can route to it. See the
[Kimi integration guide](/agent-network/integrations/kimi) for the provider side.
</Note>

## Your Providers & Models

The table lists what the caller's policies authorize, not everything the account has
connected. Each row names the provider as the administrator labelled it, with the catalog
provider underneath, and the models it may be called with:

- **All Models** — no [guardrail](/agent-network/policies/guardrails) model allowlist
  restricts this provider for you.
- One or two model names, or a count such as **3 Models** past that — the effective
  allowlist. Hover the count to read the full list.

<p>
    <img src="/docs-static/img/agent-network/connect-agent/agent-network-connect-agent-providers-models.png" alt="Your Providers & Models table listing a Bedrock provider limited to three models and an OpenAI provider with all models allowed" className="imagewrapper" />
</p>

A provider the account has connected but no policy of yours references does not appear
here, and a request to it is refused at the endpoint the same way.

## No Providers Available Yet

Agent Network denies every request by default, so a user no policy covers yet sees the
endpoint and the snippets but an empty provider list.

<p>
    <img src="/docs-static/img/agent-network/connect-agent/agent-network-connect-agent-no-providers.png" alt="Connect Agent page with an empty provider list explaining that no access policy covers the user yet" className="imagewrapper" />
</p>

The empty state states the fix in the terms of whoever is reading it:

- Users who can edit policies are pointed straight at **Policies**, where adding one of
  their groups to a policy grants them access.
- Everyone else is asked to have an administrator add them to an Agent Network access
  policy.

This is also what an account with no providers connected at all looks like from a member's
side: with nothing connected there is nothing for a policy to authorize. An administrator
starts by [connecting a provider](/agent-network/providers#connect-a-provider), then
[creating a policy](/agent-network/policies) that covers the group the user belongs to. The
page fills in as soon as both exist, no change is needed on the agent.

## What a Regular User Sees

A member with the plain **User** role gets the same page as an administrator: the same
endpoint, the same per-tool snippets, and the providers their own policies allow. Only the
sidebar differs, it carries **Connect Agent** and **Usage & Logs**, scoped to their own
requests, without Providers, Policies, or Configuration.

<p>
    <img src="/docs-static/img/agent-network/connect-agent/agent-network-connect-agent-user-role.png" alt="Connect Agent page as seen by a member with the User role, whose sidebar carries only Connect Agent and Usage & Logs under Agent Network" className="imagewrapper-big" />
</p>

This is the page to point a new user at: nothing on it needs an administrator, and it always
shows what that user in particular may call.