Connect a model or GPU provider
The sandbox needs nothing connected. To run pipelines for real, connect the providers their operators use: a model API for model calls, a GPU provider for training, a store for data.
In the console
Section titled “In the console”- Open Integrations. The page lists Connected providers first, then All providers, filterable by category.
- Select a provider. Fill its settings and its secret fields.
- Select Test connection. cairn authenticates with those credentials without saving anything, and shows Connection verified, Test failed or Could not verify, with the reason and the time it took.
- Select Connect. After a failed test the button reads Save anyway: saving is your decision, and the test result is shown so you make it knowingly.
Only owners and admins can add, change or remove connections.
Secret values are encrypted into the deployment’s secret store (the built-in encrypted vault, or Infisical). The connection keeps only a reference to the secret, never the value, so it never appears in a run’s record.
What you can connect
Section titled “What you can connect”| Category | Providers |
|---|---|
| Models | OpenAI, Anthropic, Gemini, Mistral, Cohere, Groq, Together, Fireworks, DeepInfra, DeepSeek, Ollama, vLLM, Hugging Face |
| Gateways | LiteLLM, OpenRouter |
| Compute / GPU | Docker, Kubernetes, RunPod, Vast.ai, Ray, Modal, Lambda Labs, JarvisLabs, E2B |
| SSH | any host reachable over SSH |
| Storage | S3, Google Cloud Storage, Cloudflare R2, Kaggle |
| Tracking | MLflow, Weights & Biases |
The catalog also covers observability tools, vector databases, databases,
SaaS tools and MCP servers. cairn connect providers prints the full list
with each provider’s secret fields.
From the CLI
Section titled “From the CLI”On the machine that runs cairn, cairn connect manages the same connections.
It never takes a secret value on the command line. A connection refers to an
environment variable (by default the provider’s usual one, such as
OPENAI_API_KEY) or to a vault entry:
cairn connect providers # what you can add, and each one's secret keyscairn connect add openai # a connection that reads OPENAI_API_KEYcairn connect add openai --name openai-eu --secret API_KEY=OPENAI_EU_KEYcairn connect ls # names, kinds and secret keys, never valuescairn connect test openai # authenticate now and store the resultcairn connect rm openai-eu # removes the reference, never the secretcairn connect add saves the connection, then runs the health check once.
cairn connect test exits 0 when the provider answered and 1 when the
secret is missing or the check failed:
$ cairn connect test ollama╭────────────────────────────────────────────────────────────────────╮│ ● failed — blocked: resolves to a loopback address │╰────────────────────────────────────────────────────────────────────╯Using a connection
Section titled “Using a connection”Pipelines refer to a connection by name, and its credential is resolved only
when the leg runs. The public dataset_readiness/api-and-admit pipeline, for
example, takes a connection input, the name from Connectors, and its run
record carries only that name.
- Capabilities and environments: how operators pick up a provider.
- Run your first pipeline: launch with a real provider.
- Set up your team: who can manage connections.