Skip to content
Cloud Score Docs

Integrations

Connect model providers with encrypted credentials, test them before and after saving, watch each connection's health, and see which providers can feed the semantic cache.

WhereGatewayProvidersNeeds an admin sessionNeeds credentials from a model providerOpen in Cloud Score
The Integrations page: one card per provider, connected ones with a status badge and health dots, unconnected bays with a Connect button.
Integrations: connected providers show their status and recent health checks; empty bays say what they need.
On this page

What you see

Integrations is listed in the sidebar as Gateway › Providers. One page, no tabs. Every provider Cloud Score can call has a card: a live card once you have connected it, an empty bay until then. The page has no loading copy; cards appear as soon as the lists load.

RegionWhat it shows
Heading and subtitleIntegrations, then Connect model providers. Credentials are encrypted at rest and never shown again — only the last four characters.
Provider gridOne connected card per stored connection, then one empty bay per provider type that has no connection, in this order: OpenAI, Anthropic, Google Gemini, Grok (xAI), OpenRouter, Together AI, Azure AI Foundry, Google Vertex AI, Amazon Bedrock. Azure, Vertex, and Bedrock can have several cards (one per resource, project, or region).
Connected card: badgesAn embeddings badge, Supports embeddings (1536), No embeddings API or No 1536-dim embeddings (hover it for the full reason), and a status badge, Connected, Error or Disconnected.
Connected card: mono lineskey •••• plus the last four characters of the secret, or no API key on file; the stored base URL (empty for Vertex and Bedrock); and, when you entered non-secret fields, a line such as AWS region us-east-1 · AWS access key ID AKIA… or Project ID my-proj · Location global.
Connected card: health stripUp to 20 dots, oldest on the left, green for a passed check and red for a failed one, followed by the newest check's latency in ms or —. Hover a dot for its status, latency (or no latency), and time. The strip is absent until the first check.
Connected card: error linesThe provider's last failure message, for example invalid API key or HTTP 429; Re-test failed: …; Disconnect failed: …. Each appears only when there is something to say.
Connected card: buttonsRe-test, Edit, Disconnect. Azure, Vertex, and Bedrock cards add a text link such as Add another Azure AI Foundry.
Empty bay (dashed border)The provider name, its embeddings badge, Not set up, a line naming the required fields such as needs API key, the default base URL or endpoint set when you connect, a row of dimmed dots, and Connect.
The nine provider types
ProviderEmpty bay saysDefault base URLEmbeddings badge
OpenAIneeds API keyhttps://api.openai.com/v1Supports embeddings (1536)
Anthropicneeds API keyhttps://api.anthropic.comNo embeddings API
Google Geminineeds API keyhttps://generativelanguage.googleapis.comSupports embeddings (1536)
Grok (xAI)needs API keyhttps://api.x.ai/v1No embeddings API
OpenRouterneeds API keyhttps://openrouter.ai/api/v1No 1536-dim embeddings
Together AIneeds API keyhttps://api.together.xyz/v1No 1536-dim embeddings
Azure AI Foundryneeds Endpoint · API keyendpoint set when you connectSupports embeddings (1536)
Google Vertex AIneeds Service account JSON · Locationendpoint set when you connectSupports embeddings (1536)
Amazon Bedrockneeds AWS regionendpoint set when you connectNo 1536-dim embeddings
The Connect dialog for a provider with the API key field, the Base URL field, the semantic cache note, and Test and Save buttons.
Connect a provider: paste the credential, Test it, then Save.
The Connect dialog, top to bottom
PartWhat it shows
TitleConnect OpenAI (the provider name changes). The Close icon, Escape, or a click outside closes it while idle; Cancel also closes it. Pending Test or Save keeps the dialog open.
FieldsOne input per field for that provider (table below). A required field carries a red *. Secrets are masked. Base URL is prefilled with the type's default when it has one.
Semantic cache noteSemantic cache: followed by the provider's embeddings reason; grey when the provider supports embeddings, amber when it does not.
Result lineAfter Test or a failed Save: Credentials look good. or Failed: … with the provider's message.
ButtonsCancel, Test and Save. Test and Save are disabled while required fields are blank; all fields are locked during a request.
Connect dialog fields by provider (* = required)
ProviderFields
OpenAI, Anthropic, Google Gemini, Grok (xAI), OpenRouter, Together AIAPI key *; Base URL, prefilled with the default.
Azure AI FoundryEndpoint * (placeholder https://<resource>.openai.azure.com, help Your Azure AI Foundry resource endpoint.); API key *; API version (placeholder 2025-11-15-preview, help Optional. Leave blank unless your resource rejects requests without an explicit api-version.); Embeddings deployment (placeholder text-embedding-3-small, help Optional. Deployment name of a text-embedding-3-small model, used for semantic cache lookups. Blank uses 'text-embedding-3-small'.).
Google Vertex AIService account JSON * (help Paste the full service-account key file. Needs the Vertex AI User role.); Project ID (help Defaults to the project in the service account.); Location * (placeholder global, help e.g. global, us-central1, europe-west4.).
Amazon BedrockAWS region * (placeholder us-east-1); Bedrock API key (help Long-term Bedrock API key (starts ABSK). Leave blank to use an AWS access key pair instead.); AWS access key ID (placeholder AKIA...); AWS secret access key; AWS session token (help Only for temporary STS credentials.).
The Edit dialog
PartWhat it shows
Title and introEdit Anthropic (the provider name changes), then Leave a credential blank to keep the stored value.
FieldsThe same fields as Connect. Text fields and Base URL are prefilled with the stored values; secrets start blank with the placeholder leave blank to keep current value and are never required.
Error lineThe provider's message when saving fails.
ButtonsCancel and Save. There is no Test here.

What you can do

ActionWhat happensWhat you seeConfirmation
ConnectOpens the Connect dialog for that provider type.Connect OpenAI (or the type you chose) with Base URL prefilled.no confirmation
Add another Azure AI FoundryOpens the Connect dialog for a second connection of the same type (Azure, Vertex, and Bedrock only).The same Connect dialog.no confirmation
TestChecks the typed credentials against the provider without saving anything or changing any status.Credentials look good. or Failed: …; the button reads Testing… meanwhile.no confirmation
Save (Connect)Stores the credentials encrypted. No check runs.The dialog closes and a card badged Not checked yet appears. On failure the dialog stays open with Failed: …; the button reads Saving… meanwhile.no confirmation
Re-testChecks the stored credentials, records the outcome as the card's status, and adds a health dot with no latency.Testing…, then Connected or Error with the provider's message; on a transport failure Re-test failed: ….no confirmation
EditOpens the Edit dialog for that connection.Edit Anthropic (or the type you chose).no confirmation
Save (Edit)Merges what you typed: a blank secret keeps the stored one, a blank text field clears it, a blank Base URL is left unchanged. The status is not re-checked.The dialog closes; the card keeps its old badge until Re-test or the next health check. On failure the dialog shows the provider's message; the button reads Saving… meanwhile.no confirmation
Cancel (Edit)Closes the dialog and discards what you typed.The card is unchanged.—
DisconnectDeletes the connection together with every model belonging to it and its health history.Disconnecting…, then the card vanishes and the Not set up bay returns (unless another connection of that type remains). On failure Disconnect failed: ….Confirm the named connection and current model count; Cancel makes no change
Hover a health dotNothing changes.A tooltip with the status, the latency in ms or no latency, and the check time.—
Hover an embeddings badgeNothing changes.A tooltip with the full reason the provider can or cannot feed the semantic cache.—

Step-by-step

Connect OpenAI, the shortest path to a routable provider.

  1. Click Providers under Gateway in the sidebar.

  2. On the OpenAI bay, click Connect.

    The bay is badged Not set up and reads needs API key.

  3. Paste the key into API key *.

    Leave Base URL at https://api.openai.com/v1 unless you go through a proxy.

  4. Click Test and wait for Credentials look good.

    Failed: invalid API key means the key was rejected: fix it and test again. Nothing is stored yet.

  5. Click Save.

    The card reads OpenAI, Supports embeddings (1536), Not checked yet, and key •••• with the last four characters.

  6. Click Re-test.

    The badge flips to Connected and a first dot appears whose tooltip says no latency. Within a minute the health loop adds a dot with a measured latency. Then enable models for it, as in Your first request.

Connect two Azure AI Foundry resources.

  1. On the Azure AI Foundry bay, click Connect.

    The bay reads needs Endpoint · API key and endpoint set when you connect.

  2. Fill Endpoint * and API key *.

    For example https://contoso-eastus.openai.azure.com. API version and Embeddings deployment are optional.

  3. Read the note under the fields.

    Semantic cache: text-embedding-3-small deployment (1536). Deployment name comes from the 'Embeddings deployment' field, default 'text-embedding-3-small'.

  4. Click Test, wait for Credentials look good., then click Save.

  5. On the new card, click Add another Azure AI Foundry and repeat for the second resource.

    Both cards appear. Each has its own Re-test, Edit, and Disconnect.

  6. Open Models and add the deployment names by hand.

    Azure model discovery is refused, so you enter deployment names yourself; they are specific to your resource.

Rotate an Anthropic key.

  1. On the Anthropic card, click Edit.

    Edit Anthropic opens with Leave a credential blank to keep the stored value.

  2. Type the new key into API key.

    Its placeholder reads leave blank to keep current value. Leave Base URL as it is.

  3. Click Save.

    The card's key •••• suffix changes. The status badge does not.

  4. Click Re-test to confirm Connected.

    Editing never checks the new credential; only a test does.

Remove a provider.

  1. Make sure you want to lose its models and history.

    Disconnect first names the connection and its current model count; Cancel keeps both. Confirm Disconnect to proceed.

  2. On the card, click Disconnect.

    The button reads Disconnecting…, the card vanishes, and the Not set up bay returns. Every model belonging to that connection and all of its health checks are deleted.

Examples

Anthropic-only chat, but you want the semantic cache

What you do

Connect Anthropic. The dialog note reads Semantic cache: Anthropic has no embeddings API. Semantic cache lookups need another connected provider that supports 1536-dimension embeddings. So you also connect Google Gemini.

What Cloud Score does

Routes chat to whichever models you enable, and embeds cache lookups with a connected provider that supports 1536-dimension embeddings, trying OpenAI, Azure, Google Gemini, then Google Vertex AI. Here that is Gemini, even if every chat request goes to Anthropic.

What you see

The Anthropic card badged No embeddings API and the Google Gemini card badged Supports embeddings (1536), both Connected after a Re-test.

Amazon Bedrock in two AWS regions

What you do

Connect Amazon Bedrock with AWS region * set to eu-central-1, an AWS access key ID and AWS secret access key, and Bedrock API key left blank. Then click Add another Amazon Bedrock and repeat with us-east-1.

What Cloud Score does

Derives each connection's endpoint from its region and checks the credentials with a signed request that lists the region's foundation models.

What you see

Two Amazon Bedrock cards, each with key •••• plus the last four characters of the access key ID, an empty base URL line, a config line such as AWS region eu-central-1 · AWS access key ID AKIA…, and the badge No 1536-dim embeddings: Bedrock cannot serve the semantic cache.

Reading the numbers

LabelMeaningUnit / formatShows — when
Connected / Error / DisconnectedThe outcome of the last credential or health check. Not checked yet means saved but never checked; Disconnected is a recorded health result.badgeNever; a fresh save shows Not checked yet until a check runs
key ••••The last four characters of the primary secret (the API key; for Bedrock the Bedrock API key, else the access key ID).mono textno API key on file when there is nothing to echo; always for Google Vertex AI, whose service-account JSON has no meaningful last four
Base URL lineWhere Cloud Score sends this connection's requests.URLEmpty for Google Vertex AI and Amazon Bedrock, whose endpoint is derived from Location or AWS region
Config lineThe non-secret fields you entered, each prefixed with its form label and joined by a middle dot.textLine omitted when you entered no non-secret extra fields
Health dotsThe last checks, manual Re-tests and the periodic loop alike, oldest on the left.up to 20 dotsStrip omitted until the first check
Dot tooltip latencyRound-trip time of that check.N msno latency for a manual Re-test, which measures none
Trailing latencyLatency of the newest check.N ms— when the newest check has no latency (a manual Re-test); never 0
Last error lineThe provider's last failure message for this connection.textOmitted when the last check passed
Embeddings badgeWhether this provider type can produce the 1536-dimension vectors the semantic cache compares.badgeNever; always rendered, even on an empty bay
needs …The fields you must fill to connect this type.labels joined by a middle dotno credentials if a type required nothing; none does today

Good to know

Connection identity and credential checks

Cards show the saved connection name and endpoint, region or project so multiple connections stay distinguishable. Vertex reports service-account credentials; Bedrock reveals only the last four characters of the access ID. Embeddings marked Registry fallback come from the registry rather than provider metadata. Editing any connection field clears the old Test result. Re-test and health-dot help are available by keyboard; timestamps are UTC.

Confirm the connection before disconnecting

Disconnect opens a confirmation naming the captured connection and its current model count. Cancel keeps everything. Confirming deletes the connection, its models and health history; requests may lose those candidates.

Test never touches the card; Edit never re-checks.

Test in the Connect dialog only checks what you typed, so a fresh save is always Not checked yet. Saving an edit keeps the old badge too. Click Re-test or wait for the next health check.

The health loop

While the backend health loop is running, Cloud Score checks every connection with credentials every 60 seconds, adds a dot with its latency, and updates the badge. The strip is capped at 20 dots, and the page caches the health history for 30 seconds and does not refetch it when you return to the window, so a new dot appears on the next refetch rather than the moment the check runs. History is kept for 30 days by default. If the loop is not running, status only changes when you click Re-test.

Required fields and blanks

Test and Save stay disabled until every field marked * has text. In Edit, secrets are never required but Endpoint, Location, and AWS region still are. On Edit, a blank text field clears the stored value; a blank secret keeps it; a blank Base URL is left unchanged and cannot be cleared from this form.

One connection, or several

Only Azure AI Foundry, Google Vertex AI, and Amazon Bedrock offer Add another …. Once OpenAI, Anthropic, Google Gemini, Grok (xAI), OpenRouter, or Together AI is connected, its bay disappears and there is no second connection.

Azure specifics

Cloud Score appends the path /openai/v1 to the endpoint unless you already pasted it. Model discovery is refused for Azure with Azure deployments must be added manually — deployment names are specific to your resource. Enter deployment names by hand on Models.

Vertex and Bedrock forms

Vertex requires Location in the form; Project IDfalls back to the service account's project. Bedrock requires only AWS region: supply either a Bedrock API key or an access key pair, because the form does not enforce that choice and the credential check fails without one.

What a credential check does

Test and Re-test make one cheap call to the provider (listing its models; for Vertex a token count on a probe model; for Bedrock a signed request listing foundation models) with a 10-second timeout, 5 seconds to connect. A slow or blocked network shows as a transport error inside Failed: …. Messages you may see include invalid API key, invalid or unauthorized credentials, and HTTP 429.

The embeddings badge is informational.

It never blocks saving. It says what a provider type can do, not which provider the cache is using; see Caching and deduplication for what the semantic cache needs.

If the grid stays empty

The page shows no loading text and no error text. If the provider lists fail to load, the grid simply stays empty; reload the page.

Related