# What Direct Connection does

> Direct Connection sends requests from your browser straight to the AI service - our servers never see your request, your data, or your key. What it needs, and where the toggle is.

- Canonical: https://big-agi.com/docs/feature-direct-connection
- Minimum tier: open  [Open ⊂ Free ⊂ Pro - a tier only ever ADDS to the Open baseline]
- Kind: concept · Last content update generation: 2026-07-27 · Review by: 2027-01-27
- Answers: What does Direct Connection actually take out of the path? · What do I need before I can use it? · Is Direct Connection different on my plan?

Direct Connection sends the model request from your browser straight to the AI service - Big-AGI's servers never see your request, your data, or your key. Turn it on wherever it is offered: one server less in the path, and sessions can run longer.

> **Warning:**
> Direct Connection needs a key entered in this browser. A key held by the server cannot direct-connect, and some AI services refuse browser calls altogether - those stay on the server route.

## The two routes

By default the request goes browser -> Big-AGI fast edge servers -> the AI service. That default exists because of **CORS**, a browser security protocol. Most AI services do not accept requests straight from a web page, so the edge in the middle makes every service work. With Direct Connection on, your browser calls the service itself.

| Route | The key in flight |
|---|---|
| **Via server** (default) | travels with each request to the edge, which writes it to no database, log or account |
| **Direct Connection** | never leaves the browser; the Big-AGI server does not see the request |

Big-AGI fast edge servers -> AI service, with a small CORS annotation on why the edge exists. Right lane "Direct Connection": Browser -> AI service, nothing in between, key icon staying in the browser. Right lane visually highlighted (lime accent).'>
Two lanes: the default route passes through the Big-AGI edge; Direct Connection goes from the browser straight to the AI service.

Where the key sits between requests, and what to do if it leaks, is [Keep your key safe](/docs/key-storage).

## What moves to the browser

For each service you turn it on for: **your chat turns**, the **background model calls** it serves, its **model list refresh**, and **reattaching to or deleting a run in progress**. Your browser makes each of those calls, so our server has no request to observe. The server features keep their server path, feature by feature, in [What leaves the browser](/docs/privacy-data-flow). The setting and the executor are identical on Open, Free and Pro. What differs is what gets bypassed: our edge on hosted, your own deployment on your own instance.

## Bandwidth and speed

Direct Connection downloads slightly more data. The Big-AGI edge re-encodes each streamed frame into a compact normalized form; the direct route takes the service's own wire format, scaffolding and all. The content is the same, frame for frame. In exchange the path is shorter: the AI service's closest server answers your browser directly.

## Prerequisites

> **Direct Connection works only with your API key stored in the browser**, and with an AI service that permits direct browser calls (CORS). Where it cannot be used, requests route through the Big-AGI fast edge servers instead - everything still works, within the standard upload size and time limits.

Both are checked per service, and the second is that service's decision:

| Service | Eligible when |
|---|---|
| A cloud service | its key is stored in this browser |
| A service needing more than a key - an endpoint, or an access key and its secret | every field its setup requires is filled in this browser |
| A model runtime on your own machine | always: the app falls back to the local default host, and suggests turning it on when it detects one |
| A service that refuses cross-origin browser calls | never: the toggle does not appear |

Services whose keys live in server environment variables stay on the server route ([Keys and access control](/docs/self-host-configuration)).

Five services are exceptions:

- **[Cerebras](/docs/connect-cerebras) ships with Direct Connection on.** Its API sits behind bot management that answers our server with a challenge page, while the browser passes cleanly. It is the one case where the browser route is more reliable.
- **[NVIDIA NIM](/docs/connect-nvidia-nim) is eligible only on a custom host**; the default endpoint blocks cross-origin browser requests.
- **[AWS Bedrock](/docs/connect-bedrock) shows the row once credentials are set**, and the browser call still fails - the service sends no cross-origin headers. Leave it on the server route.
- **[Sakana](/docs/connect-sakana) and [Modular](/docs/connect-modular) are server-only**, so their rows never appear. A subscription key can be excluded from an eligible service too. [Moonshot's](/docs/connect-moonshot-ai) coding-subscription keys route to an endpoint that rejects the browser preflight.

Browser access is the AI service's to grant: Anthropic's API requires an explicit opt-in header, which Big-AGI sends on this route.

## Where the toggle is

The setting is per service: Models settings -> the service -> **Advanced**. **Connect from browser** is on; **Via server (default)** is off. The Models menu's **All Services** view carries **Enable for all** and **Disable for all** for every eligible service at once. The row appears only once that service meets the precondition above.

The toggle sits in each service's panel under Advanced, with the two options named above.

## Related

- [What leaves the browser](/docs/privacy-data-flow)
- [Keep your key safe](/docs/key-storage)
- [Models on your own machines](/docs/connect-models#models-on-your-own-machines)
- [Key and access errors](/docs/issue-key-and-access)