A connection and an endpoint are separate. One connection (base URL and auth) is reused by many endpoints.

@create api asks for the name, the base URL, and the auth. When Settings has environments or customers, the form asks for those too. A new connection starts on the header choice. Changing only the environment or the customer does not require another test after the current values have already passed.

Test connection sends GET to the base URL. Any HTTP status, including 401 or 404, enables Save. DNS failure, connection refused, timeout, or a failed token request does not.

@apis lists connections, endpoints, and OpenAI connections. A blank secret on edit keeps the stored one. Names show as colour chips for the environment and the customer.

mock://users is the offline host used by the sample workspace. A test against it succeeds without a network.

Where the secret goes

API keys, bearer tokens, basic passwords, and client secrets go to the OS keychain, service com.garrardkitchen.ai-terminal, with an AES-256-GCM file fallback in the app data folder. They are not written to api_connections.json.

A vault reference is different. akv:// and op:// are saved on the connection as secret_ref and shared in a team workspace. The value is fetched when a call needs it. Secrets has the rules.

Client certificate

Client certificate on a connection is a PEM file that holds the certificate and its private key. Calls from that connection use mutual TLS. In a team workspace, a path inside the folder is stored relative. A path outside the folder is left out of the save.

Additional CA

Settings → Additional CA certificate is a corporate CA for HTTPS inspection, a .pem bundle or a .crt, .cer, or .der file. Certificate checks stay enabled. The change applies after you restart the app. This is not a way to turn verification off.