Connections

Connect an AI provider once in Cua Spaces and every app that can use it works: the providers, how to connect each one, and which apps receive what.

A connection is a provider you have signed in to or given a key for: Anthropic, OpenAI, OpenRouter and the rest. Connect it once in Settings, Connections (called Connectors before) and every app that can use it works, in every Space, with nothing to set up inside the Space.

Connect a provider#

Open Settings, Connections. Each row is one provider, with its state and the apps it works with:

• Connected: Cua has a key or sign-in for it and last saw it work.
• Needs reconnect: the provider refused the key or sign-in, or it ran out. Press Reconnect and connect it again.
• Not connected: press Connect.

The sheet shows only the ways that apply on this machine. For Anthropic that can be your Claude sign-in (found on this machine, for Claude Code only) or an API key. For OpenAI it is an API key, or your ChatGPT sign-in for Codex. Every other provider takes an API key. Anthropic, OpenAI, OpenRouter, Google AI Studio, xAI, DeepSeek, Kimi and Custom endpoint are up front; the rest are under More providers, which you can search by name.

Saving never waits on the provider. Cua checks a key in the background and only marks it Needs reconnect when the provider says it is invalid.

From the terminal:

cua connections list
printf %s "$DEEPSEEK_API_KEY" | cua connections add deepseek
cua connections test
cua connections remove deepseek

Keys are read from standard input and are never printed. cua connect is unchanged: it still connects your coding apps to Cua.

Which apps get what#

A key goes to the apps that can use it and to no others. The sign-ins are narrower still: your Claude sign-in only ever goes to Claude Code, and your ChatGPT sign-in only to Codex. Other apps use an API key for the same provider.

A key reaches a run as an environment variable of that run only, written to a file in the run's folder that only the run can read and removed from the event log. Nothing is written to the Space image or its Volume.

Hermes#

Hermes picks a provider by its own order when it is not told which, and can borrow the sign-ins of other command line tools it finds. Cua tells it instead: each run gets a generated Hermes configuration that names the provider you connected (Anthropic first, then OpenAI, OpenRouter and the rest), lists the other connected providers as fallbacks, and turns off borrowing sign-ins. If Hermes cannot reach its provider, the run fails and the thread shows the Connect card for it.

A server on your own machine#

Use Custom endpoint with the server's base URL, for example LM Studio or Ollama. A Space that is isolated from your machine cannot reach a server on it, and Cua does not change that for you: allow the port for that Space in its network settings first. The key is optional.

Providers#

The table is generated from the provider files in the Cua repository, so it is always current. Providers whose terms for third-party apps are still being checked, and providers Cua has not run end to end yet, are not listed.

Adding or hiding a provider#

Each provider is one small file in libs/cua/crates/cua-connections/providers. The generator turns the files into the tables the app, the CLI and this page read, and a test fails when any of them is out of date. Another test compares the provider names, variables and base URLs with the Hermes release Cua installs; providers/README.md in that folder says how to move that pin.