# Connections

A connection is an account or key your agents sign in with: your model provider's subscription or API key, a GitHub
installation, a password. You link it once in the Console, and agents use it by name. Open **Connections** in the
workspace.

## Link one

1. Press **Add a connection** and pick the provider.
2. Under **How it signs in**, choose the **Method** when the provider has several, such as a subscription token or
   an API key. Follow the steps the page shows for it.
3. Give it a **Name**. Launches and hires refer to it by this name.
4. Paste the value. For GitHub there's nothing to paste: you continue on GitHub, install the app there, and come back
   to the new connection's page.
5. Under **Who can use this?**, choose its **Scope**:

| Scope | Who can read it |
| --- | --- |
| **Only me** | You and your agents |
| **This workspace** | Every agent in this workspace |
| **The whole organization** | Every agent in every workspace of the organization |

If two connections have the same name, yours wins over the workspace's, and the workspace's over the
organization's. A subscription token has no choice of scope: it's one person's account, so it links to you alone.

You can also add a model connection while you hire, from the harness picker's **Connection**
([Hire an agent](/docs/hire-an-agent)).

## What an agent can reach

An agent can reach every connection its person can, not only the one it thinks with. So can the machine it runs on,
and an App's code running with it. Link at the narrowest scope that works, and hire onto Apps and Computes you trust.

A connection's page says how agents use it, under **How agents use it**: either in the environment at launch, under
the name it shows, or fetched when a program asks. **Used by** lists what uses it.

## Disconnect one

On the connection's page, under **Danger zone**, press **Disconnect…** and confirm. Every Instance in reach is refused
it on its next fetch, unless a connection with the same name at another scope takes its place. A value already in a
running container's environment stays until that container is re-created. This can't be undone, and the name is free
for a new one.

For GitHub, disconnecting removes the saved credential from Uremot. It doesn't uninstall the app from GitHub: do that
on GitHub too.

## Next

- [Variables and credentials in a desk](/docs/variables): plain values, secrets, and how a program reads them.
- For your AI: the `uremot-connections` skill uses credentials without exposing them:
  [uremot-connections](/skills/uremot-connections/SKILL.md).