Automatic or custom
Automatic is the default and the right choice for a known service. Pick it from the models.dev catalog and nemu already knows its address, the protocol it speaks and the models it offers, and keeps context windows and pricing current without you maintaining them. Custom is for anything the catalog does not know: a local server, a private deployment, a proxy of your own. You supply the address and say which protocol it speaks.
Pick OpenAI Responses for a service that only speaks the Responses API. It
is also the only mode that passes a request through untouched, so server-side
built-in tools survive the trip.
Fields
The name becomes the first half of every model’s public name, so
anthropic
gives you anthropic/something. Keep it lowercase, which is what the form
does for you.
User agent
Some providers only answer clients they recognise. The picker carries presets for Claude Code, Cline, Roo Code, Kilo Code, the Codex CLI, OpenCode and Cursor, or you can type your own. It is only sent when your own request does not already carry one.Custom headers
Some services want more than a bearer token: an account id, a tenant, a project, or an entirely different authentication header. Open Customize headers next to the user agent, or Use custom header next to the API key, and add as many as you need. A new empty row appears as soon as you fill the last one. Each row can be marked Sensitive, which is on by default for any header whose name looks like a credential, such asAuthorization, X-Api-Key or
anything containing token or secret. A sensitive value is sealed in the
vault exactly like an API key: it is never sent back to the console, it shows as
dots, and double clicking it clears it so you can type a replacement.
Custom headers are applied last, so a header you set replaces the one nemu would
have sent by default. Adding your own Authorization header therefore overrides
the API key field, which is how you connect to a service that does not use
bearer tokens. A provider with custom headers and no API key is valid.
Host, Content-Length and Connection are managed by the gateway and cannot
be set. The limit is 20 headers per provider.
Where the key goes
Not into the database. It is encrypted with a key derived for your account alone, stored in a secrets vault, and the database keeps only a pointer. Deleting a provider destroys the secret. Rotating one seals the new key before destroying the old.Base URL safety
A custom address has to be https, and it is resolved before being accepted. Private and loopback ranges are rejected, so a provider cannot be pointed at something inside our network.Priority
Priority orders your provider list, which also ordersGET /v1/models.
It does not choose between providers and there is no failover. A request
names one model, and that model belongs to exactly one provider. If you want
fallback behaviour, that is what workflows are for.